IDMAP_SSS(8)

📦
version 2.13.1 · 21 versions
, in fedora 43, fedora 44

✨ idmap_sss — bestie edition 💅

okay so you're looking at idmap_sss(8), which lives in the SSSD Manual pages section 8, and honestly? it's a whole vibe. it's SSSD's idmap_sss backend for Winbind. that's the name, that's the game. 🎀

🌸 NAME 🌸

idmap_sss — SSSD's idmap_sss Backend for Winbind 🦋

💖 DESCRIPTION 💖

so the idmap_sss module is literally just a little bridge that lets you call SSSD to map UIDs, GIDs and SIDs. that's it. that's the whole job. ✨

and here's the cute part: no database is required in this case, because the mapping is done by SSSD itself. no local storage, no bookkeeping, SSSD just handles it. it's giving effortless. 😌💅

✨ IDMAP OPTIONS ✨

  • range = low - high — this defines the available matching UID and GID range for which the backend is authoritative. like, this is your turf, this range right here, nobody else's. 👑

🫶 EXAMPLES 🫶

here's how you configure idmap_sss as the default mapping module. copy it, love it, ship it:

[global]
security = ads
workgroup = <AD-DOMAIN-SHORTNAME>

idmap config <AD-DOMAIN-SHORTNAME> : backend        = sss
idmap config <AD-DOMAIN-SHORTNAME> : range          = 200000-2147483647

idmap config * : backend        = tdb
idmap config * : range          = 100000-199999

okay so a few things, bestie, don't skip these 📝

  • please replace <AD-DOMAIN-SHORTNAME> with the NetBIOS domain name of the AD domain. yes, the actual one, not the placeholder, i'm begging 😭
  • if multiple AD domains should be used, each domain needs its own idmap config line with backend = sss and its own line with a suitable range. one each. no sharing. 🌈
  • and because Winbind requires a writeable default backend while idmap_sss is read-only, the example includes backend = tdb as the default. that's why it's there, it's not random, it's load-bearing 🧚
ngl the read-only thing trips people up, so like… re-read that last bullet. the tdb default is doing a job. 💀

👑 SEE ALSO 👑

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8), sss_rpcidmapd(5), sssd-systemtap(5)

like a whole reading list, go off 📚✨

💜 AUTHORS 💜

the SSSD upstream — https://github.com/SSSD/sssd/ 🌟

and that's the page!! this whole thing came out of the SSSD source, version-dated 07/08/2026, filed under IDMAP_SSS(8). mwah. 💋 stay mapped, bestie 🦋💖

📦 where this page comes from