About storing account information
Access Appliance maps between the domain users and groups (their identifiers) and local representation of these users and groups. Information about these mappings can be stored locally on Access Appliance or remotely using the DC directory service. Access Appliance uses the idmap_backend configuration option to decide where this information is stored.
This option can be set to one of the following:
rid | Maps SIDs for domain users and groups by deriving UID and GID from RID on the Access Appliance CIFS server. |
ldap | Stores the user and group information in the LDAP directory service. |
hash | Maps SIDs for domain users and groups to 31-bit UID and GID by the implemented hashing algorithm on the Access Appliance CIFS server. |
ad | Obtains unique user IDs (UIDs) or group IDs (GIDs) from domains by reading ID mappings from an Active Directory server that uses RFC2307/SFU schema extensions. |
Note:
SID/RID are Microsoft Windows concepts that are described at: http://msdn.microsoft.com/en-us/library/aa379602(VS.85).aspx.
The rid and hash values can be used in any of the following modes of operation:
Standalone
AD domain
rid is the default value for idmap_backend in all of these operational modes. The ldap value can be used if the AD domain mode is used.
When security is set as "user" idmap_backend is irrelevant.
Table: Store account information commands
Command | Definition |
|---|---|
set idmap_backend rid | Configures Access Appliance to store information about users and groups locally. Trusted domains are allowed if allow_trusted_domains is set to yes. The uid_range is set to 10000-1000000 by default. Change the default range in cases where it is not appropriate to accommodate local Access Appliance cluster users, Active Directory, or trusted domain users. Do not attempt to modify LOW_RANGE_ID (10000) if user data has already been created or copied on the CIFS server. This may lead to data access denied issues since the UID changes. |
set idmap_backend hash | Allows you to obtain the unique SID to UID/GID mappings by the implemented hashing algorithm. Trusted domains are allowed if allow_trusted_domains is set to yes. |
set idmap_backend ad | Allows you to obtain unique user IDs (UIDs) or group IDs (GIDs) from domains by reading ID mappings from an Active Directory server that uses RFC2307/SFU schema extensions. |
set idmap_backend ldap | Configures Access Appliance to store information about users and groups in a remote LDAP service. You can only use this command when Access Appliance is operating in the AD domain mode. The LDAP service can run on the domain controller or it can be external to the domain controller. Note: For Access Appliance to use the LDAP service, the LDAP service must include both RFC 2307 and proper schema extensions. See Configuring the LDAP client for authentication using the CLI. This option tells the CIFS server to obtain SID to UID/GID mappings from a common LDAP backend. This option is compatible with multiple domain environments. So allow_trusted_domains can be set to yes. If idmap_backend is set to ldap, you must first configure the Access Appliance LDAP options using the Network> ldap commands. |