IDMAP_TDB2(8)

✨ IDMAP_TDB2 ✨

okay bestie, welcome to the manual page for idmap_tdb2 — that's Samba's idmap_tdb2 Backend for Winbind 🫶 the little plugin that keeps your SID/uid/gid mapping table from falling apart when you've got a cluster doing its thing. it's giving glue holding the whole vibe together. no cap.

---

💖 DESCRIPTION 💖

so, the idmap_tdb2 plugin is basically the understudy for the default idmap_tdb backend that winbindd uses to store SID/uid/gid mapping tables — except tdb2 is the one you want in clustered environments with Samba and CTDB. slay. ✨

and here's the tea 🍓: unlike the read-only backends (looking at you, idmap_rid), this one is an allocating backend. what does that mean? it means it actually has to allocate brand-new user and group IDs in order to create new mappings. it's not just reading the vibes, it's out here manifesting fresh IDs. main character energy fr fr. 👑

---

🌸 IDMAP OPTIONS 🌸

• range = low - high — defines the available matching uid and gid range for which the backend is authoritative. that's its kingdom, its territory, its whole domain. 💅
• script — you can use this option to configure an external program to do the id mappings for you instead of relying on the tdb counter. the mappings then get stored in the tdb2 idmap database. for the full rundown, go read the IDMAP SCRIPT section below. it's right there bestie, keep scrolling. 🦋

---

🎀 IDMAP SCRIPT 🎀

okay so the tdb2 idmap backend supports an external program for performing id mappings, and you hook it up through the smb.conf option idmap config * : script — or through its deprecated legacy form idmap : script.

heads up: that legacy form is deprecated, so like… maybe don't, bestie. 🙈

now, the mappings you get from the script get stored in the idmap tdb2 database instead of the mappings created by the incrementing id counters. and here's the part that matters, so pay attention:

it is therefore important that the script covers the complete range of SIDs that can be passed in for SID to Unix ID mapping. if it doesn't, SIDs that the script didn't map might end up getting mapped to IDs that had previously been mapped by the script. and that's messy. that's a whole collision situation. we don't want that. 😭

the script should accept the following command line options:

SIDTOID S-1-xxxx
IDTOSID UID xxxx
IDTOSID GID xxxx

and it should return one of the following responses, as a single line of text:

UID:yyyy
GID:yyyy
SID:yyyy
ERR:yyyy

that's it. one line. no paragraphs, no essay, no group-chat monologue. just the line. periodt. 💅

---

⭐ EXAMPLES ⭐

this example shows how tdb2 is used as the default idmap backend:

[global]
idmap config * : backend = tdb2
idmap config * : range = 1000000-2000000

and this example shows how tdb2 is used as the default idmap backend using an external program via the script parameter:

[global]
idmap config * : backend = tdb2
idmap config * : range = 1000000-2000000
idmap config * : script = /usr/local/samba/bin/idmap_script.sh

iconic. ate. no notes. 🔥

---

👑 AUTHOR 👑

the original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project, similar to the way the Linux kernel is developed. literally legends, we stan. 🌈

---

and that's the whole page, bestie — written against Samba 4.24.7, dated 09/09/2026, and it's an IDMAP_TDB2(8) situation. go forth and map those SIDs. i'm obsessed with you. 🫶💖✨