Setting this parameter to yes allows the default idmap back-end to be switched to a read only mode, which means that it can not allocate new user or group IDs to create new mappings. Normally, the default idmap back-end is a so called allocating back-end that creates user and group ids and new mappings as needed. Whether a back-end honors the read only setting is left to the implementation of the back-end. no