| blob | 7854c02708c032ae9d242210a3ddae3cc871eab9 |
1 '\" te
2 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
4 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
5 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH IDMAP 1M "Aug 3, 2009"
7 .SH NAME
8 idmap \- configure and manage the Native Identity Mapping service
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBidmap\fR
13 .fi
15 .LP
16 .nf
17 \fBidmap\fR \fB-f\fR \fIcommand-file\fR
18 .fi
20 .LP
21 .nf
22 \fBidmap\fR add [\fB-d\fR] \fIname1\fR \fIname2\fR
23 .fi
25 .LP
26 .nf
27 \fBidmap\fR dump [\fB-n\fR] [\fB-v\fR]
28 .fi
30 .LP
31 .nf
32 \fBidmap\fR export [\fB-f\fR \fIfile\fR] \fIformat\fR
33 .fi
35 .LP
36 .nf
37 \fBidmap\fR get-namemap \fIname\fR
38 .fi
40 .LP
41 .nf
42 \fBidmap\fR help
43 .fi
45 .LP
46 .nf
47 \fBidmap\fR import [\fB-F\fR] [\fB-f\fR \fIfile\fR] \fIformat\fR
48 .fi
50 .LP
51 .nf
52 \fBidmap\fR list
53 .fi
55 .LP
56 .nf
57 \fBidmap\fR remove [\fB-t\fR|\fB-f\fR] \fIname\fR
58 .fi
60 .LP
61 .nf
62 \fBidmap\fR remove \fB-a\fR
63 .fi
65 .LP
66 .nf
67 \fBidmap\fR remove [\fB-d\fR] \fIname1\fR \fIname2\fR
68 .fi
70 .LP
71 .nf
72 \fBidmap\fR set-namemap [\fB-a\fR \fIauthenticationMethod\fR] [\fB-D\fR \fIbindDN\fR]
73 [\fB-j\fR \fIpasswdfile\fR] \fIname1\fR \fIname2\fR
74 .fi
76 .LP
77 .nf
78 \fBidmap\fR show [\fB-c\fR] [\fB-v\fR] \fIidentity\fR [\fItarget-type\fR]
79 .fi
81 .LP
82 .nf
83 \fBidmap\fR unset-namemap [\fB-a\fR \fIauthenticationMethod\fR] [\fB-D\fR \fIbindDN\fR]
84 [\fB-j\fR \fIpasswdfile\fR] \fIname\fR [\fItarget-type\fR]
85 .fi
87 .SH DESCRIPTION
88 .sp
89 .LP
90 The \fBidmap\fR utility is used to configure and manage the Native Identity
91 Mapping service.
92 .sp
93 .LP
94 The Native Identity Mapping service supports the following types of mappings
95 between Windows security identities (SIDs) and POSIX user IDs and group IDs
96 (UIDs and GIDs):
97 .RS +4
98 .TP
99 .ie t \(bu
100 .el o
101 \fBName-based mapping.\fR An administrator maps Windows and UNIX users and
102 groups by name.
103 .RE
104 .RS +4
105 .TP
106 .ie t \(bu
107 .el o
108 \fBEphemeral ID mapping.\fR A UID or GID is dynamically allocated for every SID
109 that is not already mapped by name.
110 .RE
111 .RS +4
112 .TP
113 .ie t \(bu
114 .el o
115 \fBLocal-SID mapping.\fR A non-ephemeral UID or GID is mapped to an
116 algorithmically generated local SID.
117 .RE
118 .sp
119 .LP
120 The \fBidmap\fR utility can be used to create and manage the name-based
121 mappings and to monitor the mappings in effect.
122 .sp
123 .LP
124 If the \fBidmap\fR utility is invoked without a subcommand or option, it reads
125 the subcommands from standard input. When standard input is a TTY, the
126 \fBidmap\fR command prints the usage message and exits.
127 .SS "Mapping Mechanisms"
128 .sp
129 .LP
130 The \fBidmapd\fR(1M) daemon maps Windows user and group SIDs to UNIX UIDs and
131 GIDs as follows:
132 .RS +4
133 .TP
134 1.
135 SIDs are mapped by name.
136 .sp
137 This mapping uses the name-based mappings that are manually set up by the
138 system administrator.
139 .RE
140 .RS +4
141 .TP
142 2.
143 If no name-based mapping is found, the SID is mapped to a dynamically
144 allocated ephemeral ID.
145 .sp
146 This allocation uses the next available UID or GID from 2^31 to 2^32 - 2.
147 .RE
148 .sp
149 .LP
150 Local SID mappings are used to map from UNIX to Windows.
151 .sp
152 .LP
153 To prevent aliasing problems, all file systems, archive and backup formats, and
154 protocols must store SIDs or map all UIDs and GIDs in the 2^31 to 2^32 - 2
155 range to the \fBnobody\fR user and group.
156 .sp
157 .LP
158 It is possible to create also diagonal mappings. They are the mappings between
159 Windows groups and Solaris users and between Solaris groups and Windows users.
160 They are needed when Windows uses a group identity as a file owner or vice
161 versa.
162 .SS "Name-based Mappings"
163 .sp
164 .LP
165 Name-based mappings establish name equivalence between Windows users and groups
166 and their counterparts in the UNIX name service. These mappings persist across
167 reboots. For example, the following command maps Windows users to UNIX users
168 with the same name:
169 .sp
170 .in +2
171 .nf
172 # \fBidmap add "winuser:*@mywindomain.com" "unixuser:*"\fR
173 .fi
174 .in -2
175 .sp
177 .sp
178 .LP
179 If configured to use a directory service, \fBidmapd\fR(1M) will first try to
180 use the mapping information that is stored in user or group objects in the
181 Active Directory (AD) and/or the native LDAP directory service. For example, an
182 AD object for a given Windows user or group can be augmented to include the
183 corresponding Solaris user or group name or numeric id. Similarly, the native
184 LDAP object for a given Solaris user or group can be augmented to include the
185 corresponding Windows user or group name.
186 .sp
187 .LP
188 \fBidmapd\fR(1M) can be configured to use AD and/or native LDAP directory-based
189 name mappings by setting the appropriate service management facility (SMF)
190 properties of the \fBidmap\fR service. See "Service Properties," below, for
191 more details.
192 .sp
193 .LP
194 If directory-based name mapping is not configured or if configured but not
195 found, then \fBidmapd\fR(1M) will process locally stored name-based mapping
196 rules.
197 .sp
198 .LP
199 \fBidmap\fR supports the mapping of Windows well-known names. A few of these
200 are listed below:
201 .sp
202 .in +2
203 .nf
204 Administrator
205 Guest
206 KRBTGT
207 Domain Admins
208 Domain Users
209 Domain Guest
210 Domain Computers
211 Domain Controllers
212 .fi
213 .in -2
214 .sp
216 .sp
217 .LP
218 When \fBidmap\fR rules are added, these well-known names will be expanded to
219 canonical form. That is, either the default domain name will be added (for
220 names that are not well-known) or an appropriate built-in domain name will be
221 added. Depending on the particular well-known name, this domain name might be
222 null, \fBBUILTIN\fR, or the local host name.
223 .sp
224 .LP
225 The following sequence of \fBidmap\fR commands illustrate the treatment of the
226 non-well-known name \fBfred\fR and the well-known names \fBadministrator\fR and
227 \fBguest\fR.
228 .sp
229 .in +2
230 .nf
231 # \fBidmap add winname:fred unixuser:fredf\fR
232 add winname:fred unixuser:fredf
234 # \fBidmap add winname:administrator unixuser:root\fR
235 add winname:administrator unixuser:root
237 # \fBidmap add winname:guest unixuser:nobody\fR
238 add winname:guest unixuser:nobody
240 # \fBidmap add wingroup:administrators sysadmin\fR
241 add wingroup:administrators unixgroup:sysadmin
243 # \fBidmap list\fR
244 add winname:Administrator@examplehost unixuser:root
245 add winname:Guest@examplehost unixuser:nobody
246 add wingroup:Administrators@BUILTIN unixgroup:sysadmin
247 add winname:fred@example.com unixuser:fredf
248 .fi
249 .in -2
250 .sp
252 .SS "Ephemeral Mappings"
253 .sp
254 .LP
255 The \fBidmapd\fR daemon attempts to preserve ephemeral ID mappings across
256 daemon restarts. However, when IDs cannot be preserved, the daemon maps each
257 previously mapped SID to a new ephemeral UID or GID value. The daemon will
258 never re-use ephemeral UIDs or GIDs. If the \fBidmapd\fR daemon runs out of
259 ephemeral UIDs and GIDs, it returns an error as well as a default UID or GID
260 for SIDs that cannot be mapped by name.
261 .sp
262 .LP
263 The dynamic ID mappings are not retained across reboots. So, any SIDs that are
264 dynamically mapped to UNIX UIDs or GIDs are most likely mapped to different IDs
265 after rebooting the system.
266 .SS "Local SID Mappings"
267 .sp
268 .LP
269 If no name-based mapping is found, a non-ephemeral UID or GID is mapped to an
270 algorithmically generated local SID. The mapping is generated as follows:
271 .sp
272 .in +2
273 .nf
274 local SID for UID = \fI<machine SID>\fR - \fI<1000 + UID>\fR
275 local SID for GID = \fI<machine SID>\fR - \fI<2^31 + GID>\fR
276 .fi
277 .in -2
278 .sp
280 .sp
281 .LP
282 \fI<machine SID>\fR is a unique SID generated by the \fBidmap\fR service for
283 the host on which it runs.
284 .SS "Rule Lookup Order"
285 .sp
286 .LP
287 When mapping a Windows name to a UNIX name, lookup for name-based mapping rules
288 is performed in the following order:
289 .RS +4
290 .TP
291 1.
292 \fIwindows-name\fR\fB@\fR\fIdomain\fR to \fB""\fR
293 .RE
294 .RS +4
295 .TP
296 2.
297 \fIwindows-name\fR\fB@\fR\fIdomain\fR to \fIunix-name\fR
298 .RE
299 .RS +4
300 .TP
301 3.
302 \fIwindows-name\fR\fB@*\fR to \fB""\fR
303 .RE
304 .RS +4
305 .TP
306 4.
307 \fIwindows-name\fR\fB@*\fR to \fIunix-name\fR
308 .RE
309 .RS +4
310 .TP
311 5.
312 \fB*@\fR\fIdomain\fR to \fB*\fR
313 .RE
314 .RS +4
315 .TP
316 6.
317 \fB*@\fR\fIdomain\fR to \fB""\fR
318 .RE
319 .RS +4
320 .TP
321 7.
322 \fB*@\fR\fIdomain\fR to \fIunix-name\fR
323 .RE
324 .RS +4
325 .TP
326 8.
327 \fB*@*\fR to \fB*\fR
328 .RE
329 .RS +4
330 .TP
331 9.
332 \fB*@*\fR to \fB""\fR
333 .RE
334 .RS +4
335 .TP
336 10.
337 \fB*@*\fR to \fIunix-name\fR
338 .RE
339 .sp
340 .LP
341 When mapping a UNIX name to a Windows name, lookup for name-based mapping rules
342 is performed in the following order:
343 .RS +4
344 .TP
345 1.
346 \fIunix-name\fR to \fB""\fR
347 .RE
348 .RS +4
349 .TP
350 2.
351 \fIunix-name\fR to \fIwindows-name\fR\fB@\fR\fIdomain\fR
352 .RE
353 .RS +4
354 .TP
355 3.
356 \fB*\fR to \fB*@\fR\fIdomain\fR
357 .RE
358 .RS +4
359 .TP
360 4.
361 \fB*\fR to \fB""\fR
362 .RE
363 .RS +4
364 .TP
365 5.
366 \fB*\fR to \fIwindows-name\fR\fB@\fR\fIdomain\fR
367 .RE
368 .SS "Service Properties"
369 .sp
370 .LP
371 The service properties determine the behavior of the \fBidmapd\fR(1M) daemon.
372 These properties are stored in the SMF repository (see \fBsmf\fR(5)) under
373 property group \fBconfig\fR. They can be accessed and modified using
374 \fBsvccfg\fR(1M), which requires \fBsolaris.smf.value.idmap\fR authorization.
375 The service properties for the \fBidmap\fR service are:
376 .sp
377 .ne 2
378 .na
379 \fB\fBconfig/ad_unixuser_attr\fR\fR
380 .ad
381 .sp .6
382 .RS 4n
383 Specify the name of the AD attribute that contains the UNIX user name. There is
384 no default.
385 .RE
387 .sp
388 .ne 2
389 .na
390 \fB\fBconfig/ad_unixgroup_attr\fR\fR
391 .ad
392 .sp .6
393 .RS 4n
394 Specify the name of the AD attribute that contains the UNIX group name. There
395 is no default.
396 .RE
398 .sp
399 .ne 2
400 .na
401 \fB\fBconfig/nldap_winname_attr\fR\fR
402 .ad
403 .sp .6
404 .RS 4n
405 Specify the name of the Native LDAP attribute that contains the Windows
406 user/group name. There is no default.
407 .RE
409 .sp
410 .ne 2
411 .na
412 \fB\fBconfig/directory_based_mapping\fR\fR
413 .ad
414 .sp .6
415 .RS 4n
416 Controls support for identity mapping using data stored in a directory service.
417 .sp
418 \fBnone\fR disables directory-based mapping.
419 .sp
420 \fBname\fR enables name-based mapping using the properties described above.
421 .sp
422 \fBidmu\fR enables mapping using Microsoft's Identity Management for UNIX
423 (IDMU). This Windows component allows the administrator to specify a UNIX user
424 ID for each Windows user, mapping the Windows identity to the corresponding
425 UNIX identity. Only IDMU data from the domain the Solaris system is a member of
426 is used.
427 .RE
429 .sp
430 .LP
431 Changes to service properties do not affect a running \fBidmap\fR service. The
432 service must be refreshed (with \fBsvcadm\fR(1M)) for the changes to take
433 effect.
434 .SH OPERANDS
435 .sp
436 .LP
437 The \fBidmap\fR command uses the following operands:
438 .sp
439 .ne 2
440 .na
441 \fB\fIformat\fR\fR
442 .ad
443 .sp .6
444 .RS 4n
445 Specifies the format in which user name mappings are described for the
446 \fBexport\fR and \fBimport\fR subcommands. The Netapp \fBusermap.cfg\fR and
447 Samba \fBsmbusers\fR external formats are supported. These external formats are
448 \fBonly\fR for users, not groups.
449 .RS +4
450 .TP
451 .ie t \(bu
452 .el o
453 The \fBusermap.cfg\fR rule-mapping format is as follows:
454 .sp
455 .in +2
456 .nf
457 \fIwindows-username\fR [\fIdirection\fR] \fIunix-username\fR
458 .fi
459 .in -2
460 .sp
462 \fIwindows-username\fR is a Windows user name in either the
463 \fIdomain\fR\e\fIusername\fR or \fIusername\fR\fB@\fR\fIdomain\fR format.
464 .sp
465 \fIunix-username\fR is a UNIX user name.
466 .sp
467 .LP
468 \fIdirection\fR is one of the following:
469 .RS +4
470 .TP
471 .ie t \(bu
472 .el o
473 \fB==\fR means a bidirectional mapping, which is the default.
474 .RE
475 .RS +4
476 .TP
477 .ie t \(bu
478 .el o
479 \fB=>\fR or \fB<=\fR means a unidirectional mapping.
480 .RE
481 The IP qualifier is not supported.
482 .RE
483 .RS +4
484 .TP
485 .ie t \(bu
486 .el o
487 The \fBsmbusers\fR rule-mapping format is as follows:
488 .sp
489 .in +2
490 .nf
491 \fIunixname\fR = \fIwinname1\fR \fIwinname2\fR ...
492 .fi
493 .in -2
494 .sp
496 If \fIwinname\fR includes whitespace, escape the whitespace by enclosing the
497 value in double quotes. For example, the following file shows how to specify
498 whitespace in a valid format for the \fBidmap\fR command:
499 .sp
500 .in +2
501 .nf
502 $ \fBcat myusermap\fR
503 terry="Terry Maddox"
504 pat="Pat Flynn"
505 cal=cbrown
506 .fi
507 .in -2
508 .sp
510 The mappings are imported as unidirectional mappings from Windows names to UNIX
511 names.
512 .sp
513 The format is based on the "username map" entry of the \fBsmb.conf\fR man page,
514 which is available on the \fBsamba.org\fR web site. The use of an asterisk
515 (\fB*\fR) for \fIwindows-name\fR is supported. However, the \fB@group\fR
516 directive and the chaining of mappings are not supported.
517 .sp
518 By default, if no mapping entries are in the \fBsmbusers\fR file, Samba maps a
519 \fIwindows-name\fR to the equivalent \fIunix-name\fR, if any. If you want to
520 set up the same mapping as Samba does, use the following \fBidmap\fR command:
521 .sp
522 .in +2
523 .nf
524 idmap add -d "winuser:*@*" "unixuser:*"
525 .fi
526 .in -2
527 .sp
529 .RE
530 .RE
532 .sp
533 .ne 2
534 .na
535 \fB\fIidentity\fR\fR
536 .ad
537 .sp .6
538 .RS 4n
539 Specifies a user name, user ID, group name, or group ID. \fIidentity\fR is
540 specified as \fItype\fR\fB:\fR\fIvalue\fR. \fItype\fR is one of the following:
541 .sp
542 .ne 2
543 .na
544 \fB\fBusid\fR\fR
545 .ad
546 .RS 13n
547 Windows user SID in text format
548 .RE
550 .sp
551 .ne 2
552 .na
553 \fB\fBgsid\fR\fR
554 .ad
555 .RS 13n
556 Windows group SID in text format
557 .RE
559 .sp
560 .ne 2
561 .na
562 \fB\fBsid\fR\fR
563 .ad
564 .RS 13n
565 Windows group SID in text format that can belong either to a user or to a group
566 .RE
568 .sp
569 .ne 2
570 .na
571 \fB\fBuid\fR\fR
572 .ad
573 .RS 13n
574 Numeric POSIX UID
575 .RE
577 .sp
578 .ne 2
579 .na
580 \fB\fBgid\fR\fR
581 .ad
582 .RS 13n
583 Numeric POSIX GID
584 .RE
586 .sp
587 .ne 2
588 .na
589 \fB\fBunixuser\fR\fR
590 .ad
591 .RS 13n
592 UNIX user name
593 .RE
595 .sp
596 .ne 2
597 .na
598 \fB\fBunixgroup\fR\fR
599 .ad
600 .RS 13n
601 UNIX group name
602 .RE
604 .sp
605 .ne 2
606 .na
607 \fB\fBwinuser\fR\fR
608 .ad
609 .RS 13n
610 Windows user name
611 .RE
613 .sp
614 .ne 2
615 .na
616 \fB\fBwingroup\fR\fR
617 .ad
618 .RS 13n
619 Windows group name
620 .RE
622 .sp
623 .ne 2
624 .na
625 \fB\fBwinname\fR\fR
626 .ad
627 .RS 13n
628 Windows user or group name
629 .RE
631 \fIvalue\fR is a number or string that is appropriate to the specified
632 \fItype\fR. For instance, \fBunixgroup:staff\fR specifies the UNIX group name,
633 \fBstaff\fR. The identity \fBgid:10\fR represents GID 10, which corresponds to
634 the UNIX group \fBstaff\fR.
635 .RE
637 .sp
638 .ne 2
639 .na
640 \fB\fIname\fR\fR
641 .ad
642 .sp .6
643 .RS 4n
644 Specifies a UNIX name (\fBunixuser\fR, \fBunixgroup\fR) or a Windows name
645 (\fBwinuser\fR, \fBwingroup\fR) that can be used for name-based mapping rules.
646 .sp
647 .LP
648 A Windows security entity name can be specified in one of these ways:
649 .RS +4
650 .TP
651 .ie t \(bu
652 .el o
653 \fIdomain\fR\e\fIname\fR
654 .RE
655 .RS +4
656 .TP
657 .ie t \(bu
658 .el o
659 \fIname\fR\fB@\fR\fIdomain\fR
660 .RE
661 .RS +4
662 .TP
663 .ie t \(bu
664 .el o
665 \fIname\fR, which uses the default mapping domain
666 .RE
667 If \fIname\fR is the empty string (\fB""\fR), mapping is inhibited. Note that a
668 name of \fB""\fR should not be used to preclude logins by unmapped Windows
669 users.
670 .sp
671 If \fIname\fR uses the wildcard (\fB*\fR), it matches all names that are not
672 matched by other mappings. Similarly, if \fIname\fR is the wildcard Windows
673 name (\fB*@*\fR), it matches all names in all domains that are not matched by
674 other mappings.
675 .sp
676 If \fIname\fR uses the wildcard on both sides of the mapping rule, the name is
677 the same for both Windows and Solaris users. For example, if the rule is
678 \fB"*@domain" == "*"\fR, the \fBjp@domain\fR Windows user name matches this
679 rule and maps to the \fBjp\fR Solaris user name.
680 .sp
681 Specifying the type of \fIname\fR is optional if the type can be deduced from
682 other arguments or types specified on the command line.
683 .RE
685 .sp
686 .ne 2
687 .na
688 \fB\fItarget-type\fR\fR
689 .ad
690 .sp .6
691 .RS 4n
692 Used with the \fBshow\fR and \fBunset-namemap\fR subcommands. For \fBshow\fR,
693 specifies the mapping type that should be shown. For example, if
694 \fItarget-type\fR is \fBsid\fR, \fBidmap show\fR returns the SID mapped to the
695 identity specified on the command line. For \fBunset-namemap\fR, identifies an
696 attribute within the object specified by the \fIname\fR operand.
697 .RE
699 .SH OPTIONS
700 .sp
701 .LP
702 The \fBidmap\fR command supports one option and a set of subcommands. The
703 subcommands also have options.
704 .SS "Command-Line Option"
705 .sp
706 .ne 2
707 .na
708 \fB\fB-f\fR \fIcommand-file\fR\fR
709 .ad
710 .sp .6
711 .RS 4n
712 Reads and executes \fBidmap\fR subcommands from \fIcommand-file\fR. The
713 \fBidmap\fR \fB-f\fR \fB-\fR command reads from standard input. This option is
714 not used by any subcommands.
715 .RE
717 .SS "Subcommands"
718 .sp
719 .LP
720 The following subcommands are supported:
721 .sp
722 .ne 2
723 .na
724 \fB\fBadd\fR [\fB-d\fR] \fIname1\fR \fIname2\fR\fR
725 .ad
726 .sp .6
727 .RS 4n
728 Adds a name-based mapping rule. By default, the name mapping is bidirectional.
729 If the \fB-d\fR option is used, a unidirectional mapping is created from
730 \fIname1\fR to \fIname2\fR.
731 .sp
732 Either \fIname1\fR or \fIname2\fR must be a Windows name, and the other must be
733 a UNIX name. For the Windows name, the \fBwinname\fR identity type must not be
734 used. Instead, specify one of the \fBwinuser\fR or \fBwingroup\fR types. See
735 "Operands" for information about the \fIname\fR operand.
736 .sp
737 Note that two unidirectional mappings between the same two names in two
738 opposite directions are equivalent to one bidirectional mapping.
739 .sp
740 This subcommand requires the \fBsolaris.admin.idmap.rules\fR authorization.
741 .RE
743 .sp
744 .ne 2
745 .na
746 \fB\fBdump\fR [\fB-n\fR] [\fB-v\fR]\fR
747 .ad
748 .sp .6
749 .RS 4n
750 Dumps all the mappings cached since the last system boot. The \fB-n\fR option
751 shows the names, as well. By default, only \fBsid\fRs, \fBuid\fRs, and
752 \fBgid\fRs are shown. The \fB-v\fR option shows how the mappings were
753 generated.
754 .RE
756 .sp
757 .ne 2
758 .na
759 \fB\fBexport\fR [\fB-f\fR \fIfile\fR] \fIformat\fR\fR
760 .ad
761 .sp .6
762 .RS 4n
763 Exports name-based mapping rules to standard output in the specified
764 \fIformat\fR. The \fB-f\fR \fIfile\fR option writes the rules to the specified
765 output file.
766 .RE
768 .sp
769 .ne 2
770 .na
771 \fB\fBget-namemap\fR \fIname\fR\fR
772 .ad
773 .sp .6
774 .RS 4n
775 Get the directory-based name mapping information from the AD or native LDAP
776 user or group object represented by the specified name.
777 .RE
779 .sp
780 .ne 2
781 .na
782 \fB\fBhelp\fR\fR
783 .ad
784 .sp .6
785 .RS 4n
786 Displays the usage message.
787 .RE
789 .sp
790 .ne 2
791 .na
792 \fB\fBimport\fR [\fB-F\fR] [\fB-f\fR \fIfile\fR] \fIformat\fR\fR
793 .ad
794 .sp .6
795 .RS 4n
796 Imports name-based mapping rules from standard input by using the specified
797 \fIformat\fR. The \fB-f\fR \fIfile\fR option reads the rules from the specified
798 file. The \fB-F\fR option flushes existing name-based mapping rules before
799 adding new ones.
800 .sp
801 Regardless of the external format used, the imported rules are processed by
802 using the semantics and order described in the section "Rule Lookup Order,"
803 above.
804 .sp
805 This subcommand requires the \fBsolaris.admin.idmap.rules\fR authorization.
806 .RE
808 .sp
809 .ne 2
810 .na
811 \fB\fBlist\fR\fR
812 .ad
813 .sp .6
814 .RS 4n
815 Lists all name-based mapping rules. Each rule appears in its \fBidmap add\fR
816 form.
817 .RE
819 .sp
820 .ne 2
821 .na
822 \fB\fBremove\fR [\fB-t\fR|\fB-f\fR] \fIname\fR\fR
823 .ad
824 .sp .6
825 .RS 4n
826 Removes any name-based mapping rule that involves the specified name.
827 \fIname\fR can be either a UNIX or Windows user name or group name.
828 .sp
829 The \fB-f\fR option removes rules that use \fIname\fR as the source. The
830 \fB-t\fR option removes rules that use \fIname\fR as the destination. These
831 options are mutually exclusive.
832 .sp
833 This subcommand requires the \fBsolaris.admin.idmap.rules\fR authorization.
834 .RE
836 .sp
837 .ne 2
838 .na
839 \fB\fBremove\fR \fB-a\fR\fR
840 .ad
841 .sp .6
842 .RS 4n
843 Removes all name-based mapping rules.
844 .sp
845 This subcommand requires the \fBsolaris.admin.idmap.rules\fR authorization.
846 .RE
848 .sp
849 .ne 2
850 .na
851 \fB\fBremove\fR [\fB-d\fR] \fIname1\fR \fIname2\fR\fR
852 .ad
853 .sp .6
854 .RS 4n
855 Removes name-based mapping rules between \fIname1\fR and \fIname2\fR. If the
856 \fB-d\fR option is specified, rules from \fIname1\fR to \fIname2\fR are
857 removed.
858 .sp
859 Either \fIname1\fR or \fIname2\fR must be a Windows name, and the other must be
860 a UNIX name.
861 .sp
862 This subcommand requires the \fBsolaris.admin.idmap.rules\fR authorization.
863 .RE
865 .sp
866 .ne 2
867 .na
868 \fB\fBset-namemap\fR [\fB-a\fR \fIauthenticationMethod\fR] [\fB-D\fR
869 \fIbindDN\fR] [\fB-j\fR \fIpasswdfile\fR] \fIname1\fR \fIname2\fR\fR
870 .ad
871 .sp .6
872 .RS 4n
873 Sets name mapping information in the AD or native LDAP user or group object.
874 Either \fIname1\fR or \fIname2\fR must be a Windows name, and the other must be
875 a UNIX name.
876 .sp
877 If \fIname1\fR is a Windows name, then the UNIX name \fIname2\fR is added to
878 the AD object represented by \fIname1\fR. Similarly, if \fIname1\fR is a UNIX
879 name then the Windows name \fIname2\fR is added to the native LDAP entry
880 represented by \fIname1\fR.
881 .sp
882 The following options are supported:
883 .sp
884 .ne 2
885 .na
886 \fB\fB-a\fR \fIauthenticationMethod\fR\fR
887 .ad
888 .sp .6
889 .RS 4n
890 Specify authentication method when modifying native LDAP entry. See
891 \fBldapaddent\fR(1M) for details. Default value is \fBsasl/GSSAPI\fR.
892 .RE
894 .sp
895 .ne 2
896 .na
897 \fB\fB-D\fR \fIbindDN\fR\fR
898 .ad
899 .sp .6
900 .RS 4n
901 Uses the distinguished name \fIbindDN\fR to bind to the directory.
902 .RE
904 .sp
905 .ne 2
906 .na
907 \fB\fB-j\fR \fIpasswdfile\fR\fR
908 .ad
909 .sp .6
910 .RS 4n
911 Specify a file containing the password for authentication to the directory.
912 .RE
914 .RE
916 .sp
917 .ne 2
918 .na
919 \fB\fBshow\fR [\fB-c\fR] [\fB-v\fR] \fIname\fR [\fItarget-type\fR]\fR
920 .ad
921 .sp .6
922 .RS 4n
923 Shows the identity of type, \fItarget-type\fR, that the specified \fIname\fR
924 maps to. If the optional \fItarget-type\fR is omitted, the non-diagonal mapping
925 is shown.
926 .sp
927 By default, this subcommand shows only mappings that have been established
928 already. The \fB-c\fR option forces the evaluation of name-based mapping
929 configurations or the dynamic allocation of IDs.
930 .sp
931 The \fB-v\fR option shows how the mapping was generated and also whether the
932 mapping was just generated or was retrieved from the cache.
933 .RE
935 .sp
936 .ne 2
937 .na
938 \fB\fBunset-namemap\fR [\fB-a\fR \fIauthenticationMethod\fR] [\fB-D\fR
939 \fIbindDN\fR] [\fB-j\fR \fIpasswdfile\fR] \fIname\fR [\fItarget-type\fR]\fR
940 .ad
941 .sp .6
942 .RS 4n
943 Unsets directory-based name mapping information from the AD or native LDAP user
944 or group object represented by the specified name and optional target type.
945 .sp
946 See the \fBset-namemap\fR subcommand for options.
947 .RE
949 .SH EXAMPLES
950 .LP
951 \fBExample 1 \fRUsing a Wildcard on Both Sides of a Name-Based Mapping Rule
952 .sp
953 .LP
954 The following command maps all Windows user names in the \fBxyz.com\fR domain
955 to the UNIX users with the same names provided that one exists and is not
956 otherwise mapped. If such a rule is matched but the UNIX user name does not
957 exist, an ephemeral ID mapping is used.
959 .sp
960 .in +2
961 .nf
962 # \fBidmap add "winuser:*@xyz.com" "unixuser:*"\fR
963 .fi
964 .in -2
965 .sp
967 .LP
968 \fBExample 2 \fRUsing a Wildcard on One Side of a Name-Based Mapping Rule
969 .sp
970 .LP
971 The following command maps all unmapped Windows users in the \fBxyz.com\fR
972 domain to the \fBguest\fR UNIX user. The \fB-d\fR option specifies a
973 unidirectional mapping from \fB*@xyz.com\fR users to the \fBguest\fR user.
975 .sp
976 .in +2
977 .nf
978 # \fBidmap add -d "winuser:*@xyz.com" unixuser:guest\fR
979 .fi
980 .in -2
981 .sp
983 .LP
984 \fBExample 3 \fRAdding a Bidirectional Name-Based Mapping Rule
985 .sp
986 .LP
987 The following command maps Windows user, \fBfoobar@example.com\fR, to UNIX
988 user, \fBfoo\fR, and conversely:
990 .sp
991 .in +2
992 .nf
993 # \fBidmap add winuser:foobar@example.com unixuser:foo\fR
994 .fi
995 .in -2
996 .sp
998 .sp
999 .LP
1000 This command shows how to remove the mapping added by the previous command:
1002 .sp
1003 .in +2
1004 .nf
1005 # \fBidmap remove winuser:foobar@example.com unixuser:foo\fR
1006 .fi
1007 .in -2
1008 .sp
1010 .LP
1011 \fBExample 4 \fRShowing a UID-to-SID Mapping
1012 .RS +4
1013 .TP
1014 .ie t \(bu
1015 .el o
1016 The following command shows the SID that the specified UID, \fBuid:50000\fR,
1017 maps to:
1018 .sp
1019 .in +2
1020 .nf
1021 # \fBidmap show uid:50000 sid\fR
1022 uid:50000 -> usid:S-1-5-21-3223191800-2000
1023 .fi
1024 .in -2
1025 .sp
1027 .RE
1028 .RS +4
1029 .TP
1030 .ie t \(bu
1031 .el o
1032 The following command shows the UNIX user name that the specified Windows user
1033 name, \fBjoe@example.com\fR, maps to:
1034 .sp
1035 .in +2
1036 .nf
1037 # \fBidmap show joe@example.com unixuser\fR
1038 winuser:joe@example.com -> unixuser:joes
1039 .fi
1040 .in -2
1041 .sp
1043 .RE
1044 .LP
1045 \fBExample 5 \fRListing the Cached SID-to-UID Mappings
1046 .sp
1047 .LP
1048 The following command shows all of the SID-to-UID mappings that are in the
1049 cache:
1051 .sp
1052 .in +2
1053 .nf
1054 # \fBidmap dump | grep "uid:"\fR
1055 usid:S-1-5-21-3223191800-2000 == uid:50000
1056 usid:S-1-5-21-3223191800-2001 == uid:50001
1057 usid:S-1-5-21-3223191800-2006 == uid:50010
1058 usid:S-1-5-21-3223191900-3000 == uid:2147491840
1059 usid:S-1-5-21-3223191700-4000 => uid:60001
1060 .fi
1061 .in -2
1062 .sp
1064 .LP
1065 \fBExample 6 \fRBatching \fBidmap\fR Requests
1066 .sp
1067 .LP
1068 The following commands show how to batch \fBidmap\fR requests. This particular
1069 command sequence does the following:
1071 .RS +4
1072 .TP
1073 .ie t \(bu
1074 .el o
1075 Removes any previous rules for \fBfoobar@example.com\fR.
1076 .RE
1077 .RS +4
1078 .TP
1079 .ie t \(bu
1080 .el o
1081 Maps Windows user \fBfoobar@example.com\fR to UNIX user \fBbar\fR and
1082 vice-versa.
1083 .RE
1084 .RS +4
1085 .TP
1086 .ie t \(bu
1087 .el o
1088 Maps Windows group \fBmembers\fR to UNIX group \fBstaff\fR and vice-versa.
1089 .RE
1090 .sp
1091 .in +2
1092 .nf
1093 # \fBidmap <<EOF\fR
1094 \fBremove winuser:foobar@example.com\fR
1095 \fBadd winuser:foobar@example.com unixuser:bar\fR
1096 \fBadd wingroup:members unixgroup:staff\fR
1097 \fBEOF\fR
1098 .fi
1099 .in -2
1100 .sp
1102 .LP
1103 \fBExample 7 \fRListing Name-Based Mapping Rules
1104 .sp
1105 .LP
1106 The following command shows how to list the name-based mapping rules:
1108 .sp
1109 .in +2
1110 .nf
1111 # \fBidmap list\fR
1112 add winuser:foobar@example.com unixuser:bar
1113 add wingroup:members unixgroup:staff
1114 .fi
1115 .in -2
1116 .sp
1118 .LP
1119 \fBExample 8 \fRImporting Name-Based Mapping Rules From the \fBusermap.cfg\fR
1120 File
1121 .sp
1122 .LP
1123 The \fBusermap.cfg\fR file can be used to configure name-based mapping rules.
1124 The following \fBusermap.cfg\fR file shows mapping rules that map Windows user
1125 \fBfoo@example.com\fR to UNIX user \fBfoo\fR, and that map
1126 \fBfoobar@example.com\fR to the UNIX user \fBfoo\fR.
1128 .sp
1129 .in +2
1130 .nf
1131 # \fBcat usermap.cfg\fR
1132 foo@example.com == foo
1133 foobar@example.com => foo
1134 .fi
1135 .in -2
1136 .sp
1138 .sp
1139 .LP
1140 The following \fBidmap\fR command imports \fBusermap.cfg\fR information to the
1141 \fBidmapd\fR database:
1143 .sp
1144 .in +2
1145 .nf
1146 # \fBcat usermap.cfg | idmap import usermap.cfg\fR
1147 .fi
1148 .in -2
1149 .sp
1151 .sp
1152 .LP
1153 This command does the same as the previous command:
1155 .sp
1156 .in +2
1157 .nf
1158 # \fBidmap import -f usermap.cfg usermap.cfg\fR
1159 .fi
1160 .in -2
1161 .sp
1163 .sp
1164 .LP
1165 The following commands are equivalent to the previous \fBidmap import\fR
1166 commands:
1168 .sp
1169 .in +2
1170 .nf
1171 # \fBidmap <<EOF\fR
1172 \fBadd winuser:foo@example.com unixuser:foo\fR
1173 \fBadd -d winuser:foobar@example.com unixuser:foo\fR
1174 \fBEOF\fR
1175 .fi
1176 .in -2
1177 .sp
1179 .LP
1180 \fBExample 9 \fRUsing Name-Based and Ephemeral ID Mapping With Identity
1181 Function Mapping and Exceptions
1182 .sp
1183 .LP
1184 The following commands map all users in the \fBexample.com\fR Windows domain to
1185 UNIX user accounts of the same name. The command also specifies mappings for
1186 the following Windows users: \fBjoe@example.com\fR, \fBjane.doe@example.com\fR,
1187 \fBadministrator@example.com\fR. The \fBadministrator\fR from all domains is
1188 mapped to \fBnobody\fR. Any Windows users without corresponding UNIX accounts
1189 are mapped dynamically to available ephemeral UIDs.
1191 .sp
1192 .in +2
1193 .nf
1194 # \fBidmap import usermap.cfg <<EOF\fR
1195 \fBjoe@example.com == joes\fR
1196 \fBjane.doe@example.com == janed\fR
1197 \fBadministrator@* => nobody\fR
1198 \fB*@example.com == *\fR
1199 \fB*@example.com => nobody\fR
1200 \fBEOF\fR
1201 .fi
1202 .in -2
1203 .sp
1205 .LP
1206 \fBExample 10 \fRAdding Directory-based Name Mapping to AD User Object
1207 .sp
1208 .LP
1209 The following command maps Windows user \fBjoe@example.com\fR to UNIX user
1210 \fBjoe\fR by adding the UNIX name to AD object for \fBjoe@example.com\fR.
1212 .sp
1213 .in +2
1214 .nf
1215 # \fBidmap set-namemap winuser:joe@example.com joes\fR
1216 .fi
1217 .in -2
1218 .sp
1220 .LP
1221 \fBExample 11 \fRAdding Directory-based Name Mapping to Native LDAP User Object
1222 .sp
1223 .LP
1224 The following command maps UNIX user \fBfoo\fR to Windows user
1225 \fBfoobar@example.com\fR by adding the Windows name to native LDAP object for
1226 \fBfoo\fR.
1228 .sp
1229 .in +2
1230 .nf
1231 # \fBidmap set-namemap unixuser:foo foobar@example.com\fR
1232 .fi
1233 .in -2
1234 .sp
1236 .LP
1237 \fBExample 12 \fRRemoving Directory-based Name Mapping from AD User Object
1238 .sp
1239 .LP
1240 The following command removes the UNIX username \fBunixuser\fR from the AD
1241 object representing \fBjoe@example.com\fR.
1243 .sp
1244 .in +2
1245 .nf
1246 # \fBidmap unset-namemap winuser:joe@example.com unixuser\fR
1247 .fi
1248 .in -2
1249 .sp
1251 .SH EXIT STATUS
1252 .sp
1253 .ne 2
1254 .na
1255 \fB\fB0\fR\fR
1256 .ad
1257 .RS 6n
1258 Successful completion.
1259 .RE
1261 .sp
1262 .ne 2
1263 .na
1264 \fB\fB>0\fR\fR
1265 .ad
1266 .RS 6n
1267 An error occurred. A diagnostic message is written to standard error.
1268 .RE
1270 .SH ATTRIBUTES
1271 .sp
1272 .LP
1273 See \fBattributes\fR(5) for descriptions of the following attributes:
1274 .sp
1276 .sp
1277 .TS
1278 box;
1279 c | c
1280 l | l .
1281 ATTRIBUTE TYPE ATTRIBUTE VALUE
1282 _
1283 Interface Stability Uncommitted
1284 .TE
1286 .SH SEE ALSO
1287 .sp
1288 .LP
1289 \fBsvcs\fR(1), \fBidmapd\fR(1M), \fBldapaddent\fR(1M), \fBsvcadm\fR(1M),
1290 \fBsvccfg\fR(1M), \fBattributes\fR(5), \fBsmf\fR(5)
1291 .SH NOTES
1292 .sp
1293 .LP
1294 The \fBidmapd\fR service is managed by the service management facility,
1295 \fBsmf\fR(5). The service identifier for the \fBidmapd\fR service is
1296 \fBsvc:/system/idmap\fR.
1297 .sp
1298 .LP
1299 Use the \fBsvcadm\fR command to perform administrative actions on this service,
1300 such as enabling, disabling, or restarting the service. These actions require
1301 the \fBsolaris.smf.manage.idmap\fR authorization. Use the \fBsvcs\fR command to
1302 query the service's status.
1303 .sp
1304 .LP
1305 Windows user names are case-insensitive, while UNIX user names are
1306 case-sensitive. The case of Windows names as they appear in \fBidmap\fR
1307 name-rules and \fBidmap show\fR command lines is irrelevant.
1308 .sp
1309 .LP
1310 Because common practice in UNIX environments is to use all-lowercase user
1311 names, wildcard name-rules map Windows names to UNIX user/group names as
1312 follows: first, the canonical Windows name (that is, in the case as it appears
1313 in the directory) is used as a UNIX user or group name. If there is no such
1314 UNIX entity, then the Windows name's case is folded to lowercase and the result
1315 is used as the UNIX user or group name.
1316 .sp
1317 .LP
1318 As a result of this differing treatment of case, user names that appear to be
1319 alike might not be recognized as matches. You must create rules to handle such
1320 pairings of strings that differ only in case. For example, to map the Windows
1321 user \fBsam@example\fR to the Solaris user \fBSam\fR, you must create the
1322 following rules:
1323 .sp
1324 .in +2
1325 .nf
1326 # \fBidmap add "winuser:*@example" "unixuser:*"\fR
1327 # \fBidmap add winuser:sam@example unixuser:Sam\fR
1328 .fi
1329 .in -2
1330 .sp
1332 .sp
1333 .LP
1334 For guidance on modifying an Active Directory schema, consult the Microsoft
1335 document, \fIStep-by-Step Guide to Using Active Directory Schema and Display
1336 Specifiers\fR, which you can find at their \fBtechnet\fR web site,
1337 http://technet.microsoft.com/\&.