Bug 7788 - Documentation for idmap_rid is outdated
Summary: Documentation for idmap_rid is outdated
Alias: None
Product: Samba 3.5
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 3.5.6
Hardware: Other All
: P3 normal
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
Depends on:
Reported: 2010-11-10 05:27 UTC by Björn Jacke
Modified: 2012-09-17 10:06 UTC (History)
2 users (show)

See Also:

manpage update for idmap_rid (1.77 KB, patch)
2010-12-07 14:41 UTC, Michael Adam
bjacke: review+

Note You need to log in before you can comment on or make changes to this bug.
Description Björn Jacke 2010-11-10 05:27:16 UTC
idmap_rid can't be used for the local sam, e.g. net sam createlocalgroup will fail, because idmap_rid can't allocate a gid because it's not able to allocate a ri.

Is this a limitation that is not intended and should it be fixed?

If not: then the man page should reflect the limitation and a debug level 0 log message should also say that idmap_rid can't handle that thing that is expected to be done. Maybe it would even be better if winbind would refuse to start if a domain is being handled by idmap_rid that is not supported by it.
Comment 1 Michael Adam 2010-12-01 10:35:30 UTC
In order to create group mappings (or use ldasam:editposix),
with the new(er) code, you have to have winbindd running and
the default idmap configuration (idmap backend = ...) configured
with a backend that can create unix ids, i.e. tdb, tdb2, or ldap.

The background is that the id-pool (allocator) of the default id mapping
configuration is also used as an overall samba idmap pool for all
of samba, e.g. in group mapping and ldapsam:editposix.

i.e. you need to set something like this:

idmap backend = tdb
idmap uid = 10000-20000
idmap gid = 10000-20000

idmap config SOMEDOMAIN : backend = rid
idmap config SOMEDOMAIN : range = 40000-50000

The old multidomain "idmap backend = rid..." config
is hence not supported any more.

I will check for the documentation and clarify this
and make it more explicit if required.

Cheers - MIchael
Comment 2 Michael Adam 2010-12-07 14:41:58 UTC
Created attachment 6122 [details]
manpage update for idmap_rid

I pushed this update to the idmap_rid manpage to master and v3-6-test.
Should we add this to 3.5.7, too?
Comment 3 Björn Jacke 2012-09-12 21:35:40 UTC
Comment on attachment 6122 [details]
manpage update for idmap_rid

yes, should go to 3.5 also to document that for our users :-)
Comment 4 Karolin Seeger 2012-09-17 10:06:25 UTC
Pushed to v3-5-test.
Closing out bug report.