How to Add a Directory-Based Name Mapping to a User or Group Object

This procedure shows how to perform the following directory-based name mapping:

• Mapping a Windows user or group to an Oracle Solaris user or group by adding the Oracle Solaris user or group name to the AD object for the specified Windows user.

• Mapping an Oracle Solaris user or group to a Windows user by adding the Windows user or group name to the native LDAP object for the specified Oracle Solaris user or group.

For more information about the idmap set-namemap command and its options, see the idmap(8) man page.

1. Become an administrator.

   For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.4.

2. Determine whether to augment a user or group object in AD or in the native LDAP service.

   • Augment a user object.

     • To augment the Windows user object in AD:

       $ idmap set-namemap winuser:wusername@domain-name unixuser:uusername

       For example, the following command maps Windows user [e-mail] to Oracle Solaris user firstlast by adding the Oracle Solaris name to the AD object for [e-mail].

       $ idmap set-namemap winuser:[e-mail] unixuser:firstlast

     • To augment the Oracle Solaris user object in native LDAP:

       $ idmap set-namemap unixuser:uusername winuser:wusername@domain-name

       For example, the following command maps Oracle Solaris user firstlast to Windows user [e-mail] by adding the Windows name to the native LDAP object for firstlast.

       $ idmap set-namemap unixuser:firstlast winuser:[e-mail]

   • Augment a group object.

     • To augment the Windows group object in AD:

       $ idmap set-namemap wingroup:group-name@domain-name unixgroup:group-name

       For example, the following command maps the Windows group [e-mail] to the Oracle Solaris group sales by adding the Oracle Solaris name to the AD object for [e-mail].

       $ idmap set-namemap wingroup:[e-mail] unixgroup:sales

     • To augment the Oracle Solaris group object in native LDAP:

       $ idmap set-namemap unixgroup:group-name wingroup:group-name@domain-name

       For example, the following command maps the Oracle Solaris group sales to the Windows group [e-mail] by adding the Windows name to the native LDAP object for sales.

       $ idmap set-namemap unixgroup:sales wingroup:[e-mail]