samba-mirror/examples/scripts/idmap

idmap script option for flexible UID/GID handling
-------------------------------------------------

If you are using "idmap backend = tdb2" with winbind in Samba3, then
you have the option of specifying an external script to perform
uid/gid allocation. This can be useful in situations where you are
using AD for authentication, but the AD server is not configured to
supply uid/gid mappings via the services for unix extensions and you
have a need to support a pre-existing system for uid/gid allocation.

One common situation where this arises is where you have a mixture of
NFS and CIFS clients, and the NFS clients are configured to use NIS
for their id mapping. It is quite common to have an administrative
mechanism in place to ensure that all of the NIS users have a
corresponding AD user account, but there may be no direct mechanism to
ensure that any unix uid/gid attributes in AD match those in NIS.

In this situation it would normally not be possible to share files
with correct ownership between the CIFS and NFS clients, as winbind
would normally allocate its own set of UIDs from a reserved pool, and
those uids won't match the existing ones in NIS.

The idmap script option
-----------------------

To resolve this problem the idmap tdb2 module has the ability to call
out to an external script whenever it meeds an unknown SID or UID/GID
for the first time. It is then the job of that script to provide a
mapping consistent with whatever external system is in place (such as
NIS), and return the mapped result to winbind.

Winbind will then persistently store the result of the mapping, so
that the script is not invoked more than once per user/group.

To setup the idmap script you need to set the following options:

  idmap backend = tdb2
  idmap script = /usr/local/bin/idmap.sh

where the location and name of the script is arbitrary. It just needs
to be executable by winbind. 

You then need to stop Samba, delete the key idmap cache files, and
restart Samba. The idmap files that need to be deleted are:

 - gencache.tdb
 - winbindd_cache.tdb
 - idmap2.tdb


Script operation
----------------

The script will be called by winbind in one of three ways. 

 1) idmap.sh SIDTOID <SID>
 2) idmap.sh IDTOSID UID <UID>
 2) idmap.sh IDTOSID GID <GID>

In the first form the script is being asked to map a windows SID (in
the string form "S-*") to a UID or GID. In the second form the script
is being asked to map a UID to a SID, and in the third form it is
being asked to map a GID to a SID.

SIDTOID
-------

In the first form the script is expected to output a UID or GID given
a SID. The output format is expected to be like this:

 UID:1234
or
 GID:1122

If the SID cannot be found, then the script should output an error
like this:

 ERR:Some error message

Note that it is common for the external mechanism to not know about
windows SIDs, in which case the script may use the wbinfo command to
ask winbind to change the SID into a username or group name. The
"wbinfo -s" option is the one to use.


IDTOSID UID
-----------

In this form the script is expected to turn a UID into a SID,
returning a result like this:

 SID:S-1-5-21-1110277820-2343689819-414998773-1124

or an error like this:

 ERR:Some error message

If the external mechanism that the script wants to use cannot produce
a SID, but can produce a username, then the script can convert the
username to a SID using the "wbinfo -n" option.

IDTOSID GID
-----------

In this form the script is expected to turn a GID into a SID,
returning a result like this:

 SID:S-1-5-21-1110277820-2343689819-414998773-1120

or an error like this:

 ERR:Some error message

If the external mechanism that the script wants to use cannot produce
a SID, but can produce a group name, then the script can convert the
groupname to a SID using the "wbinfo -n" option.


Testing the script
------------------

It is suggested that you test the script on the command line first,
before using it in winbind. To do that first get a list of users you
would like to test using the command "wbinfo -u". Let's assume one of
those users is "DC01\tridge". You would then test the script as
follows:

  [root ~]# wbinfo -n 'DC01\tridge'
  S-1-5-21-1110277820-2343689819-414998773-1124 User (1)

  [root ~]# /usr/local/bin/idmap.sh SIDTOID S-1-5-21-1110277820-2343689819-414998773-1124
  UID:1003

  [root ~]# /usr/local/bin/idmap.sh IDTOSID UID 1003
  SID:S-1-5-21-1110277820-2343689819-414998773-1124

Once those steps pass, you can enable the script in winbind
(remembering to clear the cache tdbs), and test using the id command:

  [root ~]# id 'DC01\tridge'
  uid=1003(DC01\tridge) gid=10000009(DC01\domain users)


nsswitch.conf
-------------

When using the idmap script option you setup nsswitch.conf as usual
for winbind, with one addition. If your external idmap mechanism
support nsswitch then you may optionally choose to add it to
nsswitch.conf, but you must add it after the winbind entry. So for
example, if using NIS, you could have a nsswitch.conf entry like this:

  passwd:     files winbind nis
  group:      files winbind nis

Adding this to nsswitch.conf is not essential, but may be useful for
some local administration tools.

Sample script
-------------

This directory contains a simple example script 'idmap_nis.sh' that
provides idmap script support for NIS. To use it you first need to
enable the NIS client on your Samba server, usually by configuring
/etc/yp.conf. See the manual page for yp.conf for details. 

You should test the ypcat and ypmatch commands and make sure they work
before enabling the idmap_nis.sh script.