This option allows you to specify a file containing
a mapping of usernames from the clients to the server. This can be
used for several purposes. The most common is to map usernames
that users use on DOS or Windows machines to those that the UNIX
box uses. The other is to map multiple users to a single username
so that they can more easily share files.The map file is parsed line by line. Each line should
contain a single UNIX username on the left then a '=' followed
by a list of usernames on the right. The list of usernames on the
right may contain names of the form @group in which case they
will match any UNIX username in that group. The special client
name '*' is a wildcard and matches any name. Each line of the
map file may be up to 1023 characters long.The file is processed on each line by taking the
supplied username and comparing it with each username on the right
hand side of the '=' signs. If the supplied name matches any of
the names on the right hand side then it is replaced with the name
on the left. Processing then continues with the next line.If any line begins with a '#' or a ';' then it is ignoredIf any line begins with an '!' then the processing
will stop after that line if a mapping was done by the line.
Otherwise mapping continues with every line being processed.
Using '!' is most useful when you have a wildcard mapping line
later in the file.For example to map from the name admin
or administrator to the UNIX name
root you would use:root = admin administratorOr to map anyone in the UNIX group system
to the UNIX name sys you would use:sys = @systemYou can have as many mappings as you like in a username map file.If your system supports the NIS NETGROUP option then
the netgroup database is checked before the /etc/group
database for matching groups.You can map Windows usernames that have spaces in them
by using double quotes around the name. For example:tridge = "Andrew Tridgell"would map the windows username "Andrew Tridgell" to the
unix username "tridge".The following example would map mary and fred to the
unix user sys, and map the rest to guest. Note the use of the
'!' to tell Samba to stop processing if it gets a match on
that line.
!sys = mary fred
guest = *
Note that the remapping is applied to all occurrences
of usernames. Thus if you connect to \\server\fred and
fred is remapped to mary then you
will actually be connecting to \\server\mary and will need to
supply a password suitable for mary not
fred. The only exception to this is the
username passed to the
password server (if you have one). The password
server will receive whatever username the client supplies without
modification.Also note that no reverse mapping is done. The main effect
this has is with printing. Users who have been mapped may have
trouble deleting print jobs as PrintManager under WfWg will think
they don't own the print job.
Samab versions prior to 3.0.8 would only support reading the fully qualified
username (e.g.: DOMAIN\user) from the username map when performing a
kerberos login from a client. However, when looking up a map
entry for a user authenticated by NTLM[SSP], only the login name would be
used for matches. This resulted in inconsistent behavior sometimes
even on the same server.
The following functionality is obeyed in version 3.0.8 and later:
When performing local authentication, the username map is
applied to the login name before attempting to authenticate
the connection.
When relying upon a external domain controller for validating
authentication requests, smbd will apply the username map
to the fully qualified username (i.e. DOMAIN\user) only
after the user has been successfully authenticated.
no username map/usr/local/samba/lib/users.map