IDMAP_RFC2307(8)

📦
version 4.24.7 · 27 versions
, in fedora 44

💖 IDMAP_RFC2307 💖

okay so bestie, welcome to idmap_rfc2307, aka Samba's idmap_rfc2307 Backend for Winbind. yes it's a whole mouthful. yes it's iconic. let's get into it 🫶

✨ NAME ✨

idmap_rfc2307 — Samba's idmap_rfc2307 Backend for Winbind. that's the whole name, that's the whole vibe 💅

🌸 DESCRIPTION 🌸

so the idmap_rfc2307 plugin gives winbind a way to read id mappings from records in an LDAP server, exactly as defined in RFC 2307. the LDAP server can be stand-alone, or it can be the LDAP server that the AD server itself provides. either way, an AD server is always required to provide the mapping between name and SID, and then the LDAP server gets queried for the mapping between name and uid/gid. note that this module implements only the "idmap" API, and it is READONLY. no writes. none. don't even try it 💀

Mappings must be provided in advance by the administrator — like, you have to create the user accounts in the Active Directory server and the posixAccount and posixGroup objects in the LDAP server. and the names in the Active Directory server and in the LDAP server have to be the same. matching. twins. no cap.

This id mapping approach allows the reuse of existing LDAP authentication servers that store records in the RFC 2307 format. recycling? we love her 🌈

When connecting to the LDAP server provided by an AD server, the parameter ldap ssl ads determines whether SSL should be used. When using a stand-alone LDAP server, ldap ssl applies instead. different knob, same energy 🔥

👑 IDMAP OPTIONS 👑

  • range = low - high — defines the available matching UID and GID range for which the backend is authoritative. heads up though: the range acts as a filter. if you specify it, any UID or GID stored in AD that falls outside the range gets ignored and the corresponding map is discarded. it's intended as a way to avoid accidental UID/GID overlaps between local and remotely defined IDs. so it's like a velvet rope at the club 🎀
  • ldap_server = <ad | stand-alone > — defines the type of LDAP server to use. this can either be the LDAP server provided by the Active Directory server (ad) or a stand-alone LDAP server. pick your fighter ✨
  • bind_path_user — specifies the search base where user objects can be found in the LDAP server. where the users live 🏠
  • bind_path_group — specifies the search base where group objects can be found in the LDAP server. where the groups live 🏠
  • user_cn = <yes | no> — query the cn attribute instead of the uid attribute for the user name in LDAP. this option is not required, and the default is no. lowkey optional, highkey useful 🦋
  • realm — append @realm to cn for groups (and users, if user_cn is set) in LDAP queries. this option is not required, and the default is not to append the realm. so like, off by default, periodt 💅
  • ldap_domain — when using the LDAP server in the Active Directory server, this allows one to specify the domain where to access the Active Directory server. this allows using trust relationships while keeping all RFC 2307 records in one place. this parameter is optional, and the default is to access the AD server in the current domain to query LDAP records. trust issues but make it functional 💜
  • ldap_url — when using a stand-alone LDAP server, this parameter specifies the ldap URL for accessing the LDAP server. the address, bestie 📍
  • ldap_user_dn — defines the user DN to be used for authentication. the secret for authenticating this user should be stored with net idmap secret (see net(8)). if absent, an anonymous bind will be performed. no DN, no secret, no problem (well, anonymous, but still) 🙈

🎀 EXAMPLES 🎀

The following example shows how to retrieve id mappings from a stand-alone LDAP server. This example also shows how to leave a small non conflicting range for local id allocation that may be used in internal backends like BUILTIN. look at her go ⭐

         [global]
         idmap config * : backend = tdb
         idmap config * : range = 1000000-1999999

         idmap config DOMAIN : backend = rfc2307
         idmap config DOMAIN : range = 2000000-2999999
         idmap config DOMAIN : ldap_server = stand-alone
         idmap config DOMAIN : ldap_url = ldap://ldap1.example.com
         idmap config DOMAIN : ldap_user_dn = cn=ldapmanager,dc=example,dc=com
         idmap config DOMAIN : bind_path_user = ou=People,dc=example,dc=com
         idmap config DOMAIN : bind_path_group = ou=Group,dc=example,dc=com

🌈 AUTHOR 🌈

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. legends only, fr fr 👑

and that's the whole page bestie 💖 this was Samba 4.24.7, dated 09/09/2026, straight out of the System Administration tools corner of the manual — go forth and map those ids, you've got this 🦋✨

📦 where this page comes from