The following syntax shows the proper form of a passwd entry:
username:password:uid:gid:gecos:home-directory:login-shell
See the passwd(4) man page for more information.
The nss_ad module retrieves passwd information from AD as follows:
username – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, johnd@example.com.
password – Field uses the value of x because the user password is not available in the AD object.
uid – Field uses the Windows user's SID from the objectSID AD attribute, which is mapped to the UID by using the idmap service.
gid – Field uses the Windows user's primary group SID, which is mapped to the GID by using the idmap service. The group SID is obtained by appending the value of the primaryGroupID AD attribute to the domain SID. For users in AD, the primaryGroupID attribute is an optional attribute, so it might not exist. If the attribute does not exist, nss_ad uses the idmap diagonal mapping facility to map the user SID from the objectSID attribute.
gecos – Value of the CN AD attribute.
home-directory – Value of the homeDirectory AD attribute, if a value exists. Otherwise, the field is left empty.
login-shell – Field is left empty because there is no login shell attribute in the native AD schema.