Idmap config rid: Difference between revisions
Mmuehlfeld (talk | contribs) m (Updated local range end) |
mNo edit summary |
||
(19 intermediate revisions by 2 users not shown) | |||
Line 1: | Line 1: | ||
= Introduction = |
= Introduction = |
||
The <code>rid</code> ID mapping back end implements a read-only API to retrieve account and group information from an Active Directory (AD) Domain Controller (DC) or NT4 primary domain controller (PDC). The back end assigns IDs from an |
The <code>rid</code> ID mapping back end implements a read-only API to retrieve account and group information from an Active Directory (AD) Domain Controller (DC) or NT4 primary domain controller (PDC). The back end assigns IDs from an individual per-domain range set in the <code>smb.conf</code> file and stores them in them in a local database. For details, how the local ID and the relative identifier (RID) are calculated, see the <code>idmap_rid(8)</code> man page. Because the <code>rid</code> back end is read-only, it is unable to assign new ID, such as for <code>BUILTIN</code> groups. Thus this back end cannot be set as <code>idmap config *</code> default ID mapping back end. |
||
For alternatives, see [[Identity_Mapping_Back_Ends|Identity Mapping Back Ends]]. |
|||
{{Imbox |
{{Imbox |
||
| type = |
| type = warning |
||
| text = ID mapping back ends are not supported in the <code>smb.conf</code> file on a Samba Active Directory (AD) domain controller (DC).<br />Do not add any idmap config lines to a Samba Active Directory (AD) domain controller (DC) smb.conf<br />For details, see [[Updating_Samba#Updating_Samba#Failure_To_Access_Shares_on_Domain_Controllers_If_idmap_config_Parameters_Set_in_the_smb.conf_File|Failure to Access Shares on Domain Controllers If idmap config Parameters Set in the smb.conf File]]. |
|||
| text = This back end is not supported to be configured locally on a Samba AD DC. |
|||
}} |
}} |
||
For details, how the local ID and the relative identifier (RID) are calculated, see the <code>smb.conf(5)</code> man page. |
|||
Alternatives to the <code>rid</code> back end: |
|||
* [[Idmap_config_ad|idmap config ad]] |
|||
* [[Idmap_config_autorid|idmap config autorid]] |
|||
= Advantages and Disadvantages of the <code>rid</code> Back End = |
|||
Advantages: |
Advantages: |
||
Line 22: | Line 20: | ||
* Used IDs are tracked automatically. |
* Used IDs are tracked automatically. |
||
* Requires only read access to domain controllers. |
* Requires only read access to domain controllers. |
||
* All domain |
* All domain user accounts and groups are automatically available on the domain member. |
||
* No attributes need to be set for domain users and groups. |
* No attributes need to be set for domain users and groups. |
||
* If you use the the same basic <code>smb.conf</code> file on all Samba domain members, then user and group IDs will always be the same. |
|||
* You can use the setting: <code>winbind use default domain = yes</code> and users will be in the form <code>username</code> instead of <code>DOMAIN\username</code>. |
|||
Disadvantages: |
Disadvantages: |
||
* All users on the domain member get the same login shell and home directory base path assigned. |
* All users on the domain member get the same login shell and home directory base path assigned. |
||
* File ownership of domain users and groups are lost, when the local ID mapping database corrupts. |
|||
* User and group IDs are not the same on other domain members using the <code>rid</code> back end, if different ID ranges are configured for a domain. |
|||
* All accounts and groups are automatically available on the domain member and individual entries cannot be excluded. |
* All accounts and groups are automatically available on the domain member and individual entries cannot be excluded. |
||
* You must add <code>idmap config</code> lines for all trusted domains. |
|||
Line 50: | Line 49: | ||
= Configuring the <code>rid</code> Back End = |
= Configuring the <code>rid</code> Back End = |
||
* |
* To configure the <code>rid</code> back end using the <code>10000-999999</code> ID range for the <code>SAMDOM</code> domain, set the following in the <code>[global]</code> section of your <code>smb.conf</code> file: |
||
security = ADS |
|||
⚫ | |||
workgroup = SAMDOM |
|||
realm = SAMDOM.EXAMPLE.COM |
|||
⚫ | |||
winbind nss info = template |
|||
log file = /var/log/samba/%m.log |
|||
⚫ | |||
log level = 1 |
|||
⚫ | |||
⚫ | |||
⚫ | |||
# and groups on a domain member. The default (*) domain: |
|||
# - must not overlap with any domain ID mapping configuration! |
|||
:* If no back end for local <code>BUILTIN</code> accounts and groups on the domain member is configured, add the <code>tdb</code> back end for <code>*</code> default domain and set an ID range. For example: |
|||
# - must use a read-write-enabled back end, such as tdb. |
|||
⚫ | |||
idmap config * : backend = tdb |
idmap config * : backend = tdb |
||
idmap config * : range = 3000-7999 |
idmap config * : range = 3000-7999 |
||
# - You must set a DOMAIN backend configuration |
|||
⚫ | |||
:* To configure the <code>rid</code> back end using the <code>10000-999999</code> ID range for the <code>SAMDOM</code> domain: |
|||
# idmap config for the SAMDOM domain |
# idmap config for the SAMDOM domain |
||
idmap config SAMDOM : backend = rid |
idmap config SAMDOM : backend = rid |
||
idmap config SAMDOM : range = 10000-999999 |
idmap config SAMDOM : range = 10000-999999 |
||
{{Imbox |
|||
| type = important |
|||
⚫ | |||
}} |
|||
{{Imbox |
|||
| type = important |
| type = important |
||
| text = For every domain, set these parameters individually. The ID ranges of the <code>*</code> default domain and all other domains configured in the <code>smb.conf</code> file must not overlap. |
| text = For every domain, set these parameters individually. The ID ranges of the <code>*</code> default domain and all other domains configured in the <code>smb.conf</code> file must not overlap. |
||
}} |
}} |
||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
⚫ | |||
* Reload Samba: |
* Reload Samba: |
||
Line 84: | Line 93: | ||
# smbcontrol all reload-config |
# smbcontrol all reload-config |
||
For further details, see the <code>smb.conf(5)</code> and <code>idmap_rid( |
For further details, see the <code>smb.conf(5)</code> and <code>idmap_rid(8)</code> man page. |
||
---- |
|||
[[Category:Active Directory]] |
|||
[[Category:Domain Members]] |
|||
[[Category:NT4 Domains]] |
Latest revision as of 11:01, 20 April 2023
Introduction
The rid
ID mapping back end implements a read-only API to retrieve account and group information from an Active Directory (AD) Domain Controller (DC) or NT4 primary domain controller (PDC). The back end assigns IDs from an individual per-domain range set in the smb.conf
file and stores them in them in a local database. For details, how the local ID and the relative identifier (RID) are calculated, see the idmap_rid(8)
man page. Because the rid
back end is read-only, it is unable to assign new ID, such as for BUILTIN
groups. Thus this back end cannot be set as idmap config *
default ID mapping back end.
For alternatives, see Identity Mapping Back Ends.
ID mapping back ends are not supported in the smb.conf file on a Samba Active Directory (AD) domain controller (DC).Do not add any idmap config lines to a Samba Active Directory (AD) domain controller (DC) smb.conf For details, see Failure to Access Shares on Domain Controllers If idmap config Parameters Set in the smb.conf File. |
Advantages and Disadvantages of the rid
Back End
Advantages:
- Easy to set up.
- Used IDs are tracked automatically.
- Requires only read access to domain controllers.
- All domain user accounts and groups are automatically available on the domain member.
- No attributes need to be set for domain users and groups.
- If you use the the same basic
smb.conf
file on all Samba domain members, then user and group IDs will always be the same. - You can use the setting:
winbind use default domain = yes
and users will be in the formusername
instead ofDOMAIN\username
.
Disadvantages:
- All users on the domain member get the same login shell and home directory base path assigned.
- All accounts and groups are automatically available on the domain member and individual entries cannot be excluded.
- You must add
idmap config
lines for all trusted domains.
Planning the ID Ranges
Before configuring the rid
back end in the smb.conf
file, select unique ID ranges Samba can use for each domain. The ranges must be continuous and big enough to enable Samba to assign an ID for every future user and group created in the domain.
The ID ranges of the * default domain and all other domains configured in the smb.conf file must not overlap. |
Configuring the rid
Back End
- To configure the
rid
back end using the10000-999999
ID range for theSAMDOM
domain, set the following in the[global]
section of yoursmb.conf
file:
security = ADS workgroup = SAMDOM realm = SAMDOM.EXAMPLE.COM log file = /var/log/samba/%m.log log level = 1 # Default ID mapping configuration for local BUILTIN accounts # and groups on a domain member. The default (*) domain: # - must not overlap with any domain ID mapping configuration! # - must use a read-write-enabled back end, such as tdb. idmap config * : backend = tdb idmap config * : range = 3000-7999 # - You must set a DOMAIN backend configuration # idmap config for the SAMDOM domain idmap config SAMDOM : backend = rid idmap config SAMDOM : range = 10000-999999
Setting the default back end is mandatory. |
For every domain, set these parameters individually. The ID ranges of the * default domain and all other domains configured in the smb.conf file must not overlap. |
- Configure the template settings. For example, to set
/bin/bash
as shell and/home/%U
as home directory path, add:
# Template settings for login shell and home directory template shell = /bin/bash template homedir = /home/%U
The values are applied to all users in all domains. Samba resolves the %U
variable to the session user name. For details, see the VARIABLE SUBSTITUTIONS
section in the smb.conf(5)
man page.
- Reload Samba:
# smbcontrol all reload-config
For further details, see the smb.conf(5)
and idmap_rid(8)
man page.