From: Michael Adam Date: Tue, 7 Dec 2010 14:47:52 +0000 (+0100) Subject: docs: clarify the idmap_ad manpage (bug #6322) X-Git-Url: http://git.samba.org/?p=metze%2Fsamba%2Fwip.git;a=commitdiff_plain;h=91d9cb48a5224c7dc443747505f9dd1071f822ed docs: clarify the idmap_ad manpage (bug #6322) The idmap_ad module can not be used as a default backend. --- diff --git a/docs-xml/manpages-3/idmap_ad.8.xml b/docs-xml/manpages-3/idmap_ad.8.xml index 9b445df8f732..3ecb07e590cb 100644 --- a/docs-xml/manpages-3/idmap_ad.8.xml +++ b/docs-xml/manpages-3/idmap_ad.8.xml @@ -25,6 +25,23 @@ by the administrator by adding the posixAccount/posixGroup classes and relative attribute/value pairs to the user and group objects in the AD. + + + Note that the idmap_ad module has changed considerably since + Samba versions 3.0 and 3.2. + Currently, the ad backend + does not work as the the default idmap backend, but one has + to configure it separately for each domain for which one wants + to use it, using disjoint ranges. One usually needs to configure + a writeable default idmap range, using for example the + tdb or ldap) + backend, in order to be able to map the BUILTIN sids and + possibly other trusted domains. The writeable default config + is also needed in order to be able to create group mappings. + This catch-all default idmap configuration should have a range + that is disjoint from any explicitly configured domain with + idmap backend ad. See the example below. +