man page for IDMAP_AD

(This used to be commit e386776e5d1f13fb4c002299089a344968b134c8)

diff --git a/docs/manpages-3/idmap_ad.8.xml b/docs/manpages-3/idmap_ad.8.xml
index fe1888211e96ff459b916c50caf82b6a4ba8adb7..bb67df74e99ebe9c12a59847e0712de0a9190534 100644 (file)
--- a/docs/manpages-3/idmap_ad.8.xml
+++ b/docs/manpages-3/idmap_ad.8.xml
@@ -15,17 +15,53 @@
 
 <refsynopsisdiv>
        <title>DESCRIPTION</title>
-       <para>TODO</para>
+       <para>The idmap_ad plugin provides a way for Winbind to read
+       id mappings from an AD server that uses RFC2307/SFU schema
+       extensions. This module implements only the &quot;idmap&quot;
+       API, and is READONLY. Mappings must be provided in advance
+       by the administrator by adding the posixAccount/posixGroup
+       classess and relative attribute/value pairs to the users and
+       groups objects in AD</para>
 </refsynopsisdiv>
 
 <refsect1>
        <title>IDMAP OPTIONS</title>
-       <para>TODO</para>
+
+       <variablelist>
+               <varlistentry>
+               <term>range = low - high</term>
+               <listitem><para>
+                       Defines the available matching uid and gid range for which the
+                       backend is authoritative. Note that the range acts as a filter.
+                       If specified any UID or GID stored in AD that fall outside the
+                       range is ignored and the corresponding map is discarded.
+                       It is intended as a way to avoid accidental UID/GID overlaps
+                       between local and remotely defined IDs.
+               </para></listitem>
 </refsect1>
 
 <refsect1>
        <title>EXAMPLES</title>
-       <para>TODO</para>
+       <para>
+       The following example shows how to retrieve idmappings from our principal and
+       and trusted AD domains. All is needed is to set default to yes. If trusted
+       domains are present id conflicts must be resolved beforehand, there is no
+       guarantee on the order confliting mappings would be resolved at this point.
+
+       This example also shows how to leave a small non conflicting range for local
+       id allocation that may be used in internal backends like BULTIN.
+       </para>
+
+       <programlisting>
+       [global]
+       idmap domain = ALLDOMAINS
+       idmap config ALLDOMAINS:backend      = ad
+       idmap config ALLDOMAINS:default      = yes
+       idmap config ALLDOMAINS:range        = 10000 - 300000000
+
+       idmap alloc backend = tdb
+       idmap alloc config:range        = 5000 - 9999
+       </programlisting>
 </refsect1>
 
 <refsect1>