idmap

Idmap, short for identity mapping, is a mechanism for translating identity information between different naming systems. In mixed Windows and Unix environments, it is used to map Windows Security Identifiers (SIDs) to Unix-style user and group IDs (UIDs and GIDs). This mapping enables correct file ownership and access control on POSIX filesystems when accessing resources from a Windows domain or a Samba domain.

In Samba and related systems, idmap is a framework consisting of a daemon (idmapd) and multiple backend backends. The idmapd daemon runs on UNIX-like hosts and maintains mappings between SIDs and UIDs/GIDs, storing the mappings in a backend-specific database. The set of backends you can configure depends on the Samba version but commonly includes rid, tdb, and ad. The rid backend derives IDs from the RID portion of a SID, the tdb backend uses a local on-disk database, and the ad backend uses an Active Directory or AD-like directory service for mapping.

Configuration is typically done in smb.conf or idmap.conf, with per-domain settings such as idmap config DOMAIN:backend and idmap config DOMAIN:range to define the UID/GID space for that domain. A wildcard domain can use a different backend, for example idmap config *:backend = tdb, to provide a default mapping.

Idmap is essential for cross-platform interoperability, ensuring that file ownership and permissions reflect the correct identities across Windows and POSIX systems. See also Samba, Active Directory, and identity management.