IDMAP_LDAP(8)

💖 IDMAP_LDAP — the idmap_ldap situation 💖

okay bestie, pull up a chair, because we're talking about idmap_ldap, aka Samba's idmap_ldap Backend for Winbind. yes it lives in section 8 of the manual, yes it's a System Administration tool, and yes it's lowkey iconic. let's get into it 🫶

---

✨ NAME ✨

idmap_ldap — Samba's idmap_ldap Backend for Winbind. that's it, that's the name, she's simple and she knows it 💅

---

🌸 DESCRIPTION 🌸

so the idmap_ldap plugin is literally the way for Winbind to store and retrieve SID/uid/gid mapping tables inside an LDAP directory service. like, that's her whole job. she keeps your mappings in LDAP and she's very good at it 🎀

and here's the tea: unlike the read only backends (looking at you, idmap_rid), she is an allocating backend. which means — and this is important — she has to allocate new user and group IDs in order to create new mappings. she's out here handing out IDs like friendship bracelets. not a read-only vibe at all. main character energy fr fr 👑

---

💜 IDMAP OPTIONS 💜

every single one of these, no skips, no skimming, i know you'd scroll past the boring ones but they're all important bestie:

• ldap_base_dn = DN — this one sets the directory base suffix used for SID/uid/gid mapping entries. if you don't define it, idmap_ldap will default to using the "ldap idmap suffix" option from /etc/samba/smb.conf. so like, it's got a backup plan, she's prepared 💅
• ldap_user_dn = DN — the user DN used for authentication. the secret for authenticating this user should be stored with net idmap secret (check net(8) for that). and if it's absent? then the ldap credentials from the ldap passdb configuration get used instead. and if those are also absent?? an anonymous bind gets performed as the last fallback. she's trying her best, okay 😭
• ldap_url = ldap://server/ — specifies the LDAP server to use for SID/uid/gid map entries. if you don't define it, idmap_ldap will assume that ldap://localhost/ should be used. she's a homebody, she defaults to localhost 🏠
• range = low - high — defines the available matching uid and gid range for which the backend is authoritative. this is her territory, her kingdom, her range, and she's in charge of it 👑

---

🌈 EXAMPLES 🌈

example one — ldap as the default idmap backend 🦋

this one shows how an ldap directory is used as the default idmap backend. it also configures the idmap range and the base directory suffix. and heads up: the secret for the ldap_user_dn has to be set with "net idmap secret '*' password". don't forget that part bestie, it's giving "i forgot my password" energy otherwise 🙈

        [global]
        idmap config * : backend      = ldap
        idmap config * : range        = 1000000-1999999
        idmap config * : ldap_url     = ldap://localhost/
        idmap config * : ldap_base_dn = ou=idmap,dc=example,dc=com
        idmap config * : ldap_user_dn = cn=idmap_admin,dc=example,dc=com

example two — ldap as a readonly backend, tdb as default 🧚

this next one shows how ldap can be used as a readonly backend while tdb is the default backend used to store the mappings. it adds an explicit configuration for some domain DOM1, which uses the ldap idmap backend. and note — literally note it — that a range disjoint from the default range is used. two different ranges, no overlap, no drama, we love boundaries ✨

        [global]
        # "backend = tdb" is redundant here since it is the default
        idmap config * : backend = tdb
        idmap config * : range = 1000000-1999999

        idmap config DOM1 : backend = ldap
        idmap config DOM1 : range = 2000000-2999999
        idmap config DOM1 : read only = yes
        idmap config DOM1 : ldap_url = ldap://server/
        idmap config DOM1 : ldap_base_dn = ou=idmap,dc=dom1,dc=example,dc=com
        idmap config DOM1 : ldap_user_dn = cn=idmap_admin,dc=dom1,dc=example,dc=com

---

🎀 NOTE 🎀

okay so, in order to use authentication against ldap servers, you may need to provide a DN and a password. and to avoid exposing the password in plain text in the configuration file, we store it into a security store. the "net idmap " command is used to store a secret for the DN specified in a specific idmap domain.

not me being dramatic but like — do NOT leave your password sitting in plain text in a config file. that's a vibe check failure of the highest order. use the security store. periodt 💀

---

👑 AUTHOR 👑

the original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project, similar to the way the Linux kernel is developed. legends only, no cap 🌟

---

and that's the whole page bestie!! this little beauty is from Samba 4.24.7, dated 09/09/2026, and it's the IDMAP_LDAP(8) page from the System Administration tools corner of the manual 💖✨ go forth and map your SIDs, you absolute icon 🫶