Idmap config rid
rid ID mapping back end implements a read-only API to retrieve account and group information from an Active Directory (AD) Domain Controller (DC) or NT4 primary domain controller (PDC). The back end assigns IDs from an indivudual per-domain range set in the
smb.conf file and stores them in them in a local database.
|This back end is not supported to be configured locally on a Samba AD DC.|
For details, how the local ID and the relative identifier (RID) are calculated, see the
smb.conf(5) man page.
Alternatives to the
rid back end:
Advantages and Disadvantages of the
rid Back End
- Easy to set up.
- Used IDs are tracked automatically.
- Requires only read access to domain controllers.
- All domain's user accounts and groups are automatically available on the domain member.
- No attributes need to be set for domain users and groups.
- All users on the domain member get the same login shell and home directory base path assigned.
- File ownership of domain users and groups are lost, when the local ID mapping database corrupts.
- User and group IDs are not the same on other domain members using the
ridback end, if different ID ranges are configured for a domain.
- All accounts and groups are automatically available on the domain member and individual entries cannot be excluded.
Planning the ID Ranges
Before configuring the
rid back end in the
smb.conf file, select a unique ID ranges Samba can use for each domain. The range must be continuous and big enough to enable Samba to assign an ID for every future user and group created in the domain.
|The ID ranges of the |
Setting up the
rid Back End
Set the following in the
[global] section of your
- Configure the template settings. For example, to set
/bin/bashas shell and
/home/%Uas home directory path:
# Template settings for login shell and home directory winbind nss info = template template shell = /sbin/bash template homedir = /home/%U
- The values are applied to all users in all domains. Samba resolves the
%Uvariable to the session user name. For details, see the
VARIABLE SUBSTITUTIONSsection in the
- If no back end for local
BUILTINaccounts and groups on the domain member is configured, add the
tdbback end for
*default domain and set an ID range. For example:
# Default idmap config for local BUILTIN accounts and groups idmap config *:backend = tdb idmap config *:range = 2000-9999
- Setting the default back end is mandatory.
- To configure the
ridback end using the
10000-99999ID range for the
# idmap config for the SAMDOM domain idmap config SAMDOM:backend = rid idmap config SAMDOM:range = 10000-99999
For every domain, set these parameters individually. The ID ranges of the
*default domain and all other domains configured in the
smb.conffile must not overlap.
- Reload Samba:
# smbcontrol all reload-config
For further details, see the
idmap_rid(5) man page.