Formatting Group and User Names

By default, the SMB server uses ephemeral identity mapping. Shell special characters, such as the double quote character ("), the asterisk character (*), and the backslash character (\), must be quoted when used as user names and domain names.

You define the names of Oracle Solaris and Windows users and groups by using specific formats.

For Windows groups, use one of the following formats:

wingroup:group-name@domain-name
wingroup:'domain-name\group-name'

For Windows users, use one of the following formats:

winuser:username@domain-name
winuser:'domain-name\username'

For Oracle Solaris groups, use the format unixgroup:group-name.

For Oracle Solaris users, use the format unixuser:username.

Note:

Because only directional mappings can have an empty string ("") as their target identity, if you assign an empty string as a user name or group name, the identity service does not create a mapping and the nobody ID is used for access control. Therefore, to preclude logins by unmapped Windows users, do not assign an empty string as a user name or group name.

Using the wildcard character (*) matches all user names that are not matched by other mappings. Similarly, using the wildcard Windows name (*@*) matches all user names in all domains that are not matched by other mappings.

Using the wildcard on both sides of the mapping makes the user or group name the same for both Windows and Oracle Solaris users. For example, the '*@example.com' == '*' rule ensures that the [e-mail] Windows user name maps to the user1 Oracle Solaris user name.

Note that the case of Windows names that appear in idmap name rules and in idmap show commands is ignored. However, because Windows names are not case sensitive but Oracle Solaris names are case sensitive, be careful when creating rule-based mappings that use wildcards for the user or group names.

Caution:

Using a wildcard to map Windows names to Oracle Solaris user names might not produce the expected results if user names contain uppercase characters. See the following example rules that handle this case.

Rule-based mapping rules that use the unixuser:* or unixgroup:* target map to the Oracle Solaris name as follows:

• Map the canonical Windows name, which uses the name found in the directory entry, to the matching Oracle Solaris name.

• If no such Oracle Solaris name exists, make the case of the canonical Windows name lowercase and use it as the SMB name.

As a result of this differing treatment of case, names that appear to be alike might not be recognized as matches. You must create rules to handle such pairings, as shown in the following examples.

To map Oracle Solaris user UserOne to Windows user [e-mail], you must create the following rule:

$ idmap add winuser:'*@example.com' unixuser:'*'
$ idmap add winuser:[e-mail] unixuser:UserOne

To map Oracle Solaris group Sales to Windows group [e-mail], you must create the following rule:

$ idmap add wingroup:'*@example.com' unixgroup:'*'
$ idmap add wingroup:[e-mail] unixgroup:Sales