User Name Mapping

User Name Mapping associates Windows and UNIX user names for Server for NFS. This allows users to connect to network file system (NFS) resources without having to log on to UNIX and Windows systems separately.

  • Before you begin using User Name Mapping, see Checklist: Setting up User Name Mapping.
  • For tips about using User Name Mapping, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information about User Name Mapping, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Setting up User Name Mapping

Step | Reference
Read about User Name Mapping. | Concepts
Log on as a member of the Domain Admins group, or as a domain user in the server Administrators group. |
Specify the type and names of servers that will provide UNIX user names and credentials. | To configure User Name Mapping
Configure the .maphosts file to control access to User Name Mapping. | Controlling access to User Name Mapping
Create maps between UNIX names and Windows names. If the user and group names are identical on Windows and UNIX, and if you want to map identical names directly to each other, you can create simple maps. If the Windows and UNIX names are not identical, or if you want to map one name to several other names, create advanced maps. | To configure simple maps To create advanced maps for users To create advanced maps for groups
Check maps to ensure that the user and group names are mapped correctly. | To view maps
When you are sure mapping is correct, back up the maps. | To back up and restore maps


Best practices

  • Create a User Name Mapping server pool
    You can use DNS round robin to create a pool of computers running User Name Mapping. This will provide improved performance on wide-area networks as well as provide failover capability when one of the servers is no longer available. For more information, see Creating a User Name Mapping server pool.
  • Refresh data whenever a user is added or changed
    To ensure that the user will have immediate access to network file system (NFS) resources, refresh the User Name Mapping database immediately after you add a user or otherwise make changes to the user's Windows or UNIX accounts that would affect the user's mapping. For information on refreshing the database, see Refresh data now.
  • Place passwd and group files on the User Name Mapping server
    If User Name Mapping is configured to use PCNFS passwd and group files, these files must be located on a hard drive on the server to ensure that User Name Mapping will be able to access the files whenever it refreshes the mapping database.
  • Use appropriate permissions to protect passwd and group files
    If you store passwd and group files on the computer running User Name Mapping, be sure to protect them with permissions that allow access only by appropriate users. It is recommended that the permissions list contain only entries that grant Full Access to SYSTEM and the Administrators group. Also, do not change the permissions that Microsoft Services for Network File System applies to other User Name Mapping configuration files.
  • Avoid loss of complex data
    To avoid loss of complex advanced maps in case of system difficulty, or to aid in transferring maps to another server, be sure to back up your User Name Mapping data whenever you change advanced maps.
  • Ensure consistency of group mapping
    To ensure proper file access, Windows and UNIX groups that are mapped to each other should contain the same users, and the members of the Windows and UNIX groups should be properly mapped to each other.
  • When setting up simple or advanced mapping, specify the NIS server in addition to the NIS domain
    This will help ensure that Windows user accounts will be mapped with accounts in the intended NIS domain, in case more than one NIS domain with the same name exists on the network. This can happen if an attacker has set up an NIS master server on the network in an attempt to take control of NIS clients.
  • Specify the computers that can access User Name Mapping
    User Name Mapping requires you to identify the computers that can access User Name Mapping in the .maphosts file. (If the list in this file is empty, only the computer running User Name Mapping can access the service.) To maintain a high level of security, you should explicitly specify the computers that can access User Name Mapping, rather than using the plus sign (+) by itself to grant access to all computers. For more information, see Controlling access to User Name Mapping.


How to...

  • Start User Name Mapping
  • Stop User Name Mapping
  • Configure User Name Mapping
  • Configure simple maps
  • Remove a simple map
  • Create advanced maps for users
  • Create advanced maps for groups
  • View maps
  • Remove an advanced map
  • Set the refresh interval for maps
  • Refresh data now
  • Back up and restore maps


Start User Name Mapping

To start User Name Mapping

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Right-click User Name Mapping, and then click Start.

Note

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.

Using a command line

  • At a command prompt, type:

    mapadmin [computername] [–u user] [–p password] start

Argument | Description
computername | The name of the computer on which you want to start User Name Mapping.
–u user | The name of the user who has administrative privileges on the computer, if different from the current user
–p password | The password for the person who has administrative privileges on the computer, if different from the current user

Related Topics

mapadmin

Understanding User Name Mapping


Stop User Name Mapping

To stop User Name Mapping

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Right-click User Name Mapping, and then click Stop.

Note

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.

Using a command line

  • At a command prompt, type:

    mapadmin [computername] [–u user] [-p password] stop

Argument | Description
computername | The name of the computer on which you want to stop User Name Mapping.
user | The name of a user who has administrative privileges on the computer, if different from the current user.
password | The password for the person who has administrative privileges on the computer, if different from the current user.

Related Topics

mapadmin

Understanding User Name Mapping


Configure User Name Mapping

To configure User Name Mapping

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. Click the Configuration tab.
  4. Click Use Password and Group Files or Use Network Information Service (NIS).
  5. If you chose password and group files, in the Password file path and name and the Group file path and name boxes, type the information required, or click Browse and locate the files.
  6. To specify the refresh interval, in the Days, Hours, and Minutes boxes, type a new refresh interval in days, hours and minutes, or use the default refresh interval provided. The minimum refresh interval is five minutes.
  7. To save the settings, click Apply.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.
  • The password (passwd) and group files must be located on a hard drive on the computer running User Name Mapping. Typically, these files are copied from a PCNFS server and are periodically updated by the administrator of the User Name Mapping computer.
  • You cannot use Microsoft Services for Network File System Administration to manage User Name Mapping on a remote computer to set up maps for PCNFS users and groups.

  • The refresh interval determines how often User Name Mapping will refresh password and group information from the NIS server or passwd and group files.

Using a command line

  • At a command prompt, type one of the following:

    To choose password and group authentication and supply required information, type:

    mapadmin [computername] [–u user] [–p password] config –d ntDomain –f Passwd/GroupDirectory

    To choose NIS authentication and supply required information, type:

    mapadmin [computername] [–u user] [–p password] config –d ntDomain –y nisDomain [–n nisServer]

    To set how often User Name Mapping will refresh password and group information from the NIS server when using NIS or the passwd and group files when using PCNFS, type:

    mapadmin [computername] [–u user] [–p password] config –r [[days:]hh:]mm

    To turn simple mapping on (yes) or off (no), type:

    mapadmin [computername] [–u user] [–p password] config –i {yes|no}

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative permissions on the computer, if different from the current user.
password | The password for the person who has administrative permissions on the computer, if different from the current user.
ntDomain | The name of the Windows domain.
Passwd/GroupDirectory | The fully qualified path of the directory on the User Name Mapping computer where the passwd and group files are located.
nisDomain | The name of the NIS domain.
nisServer | The name of the NIS server (optional).
dddd:hh:mm | How often, in days, hours, and minutes, User Name Mapping will refresh password and group information from the NIS server when using NIS or the passwd and group files when using PCNFS. The minimum refresh interval is five minutes.

Notes

  • PCNFS passwd and group files must be located on a hard drive on the computer running User Name Mapping. Typically, these files are copied from a PCNFS server and are periodically updated by the administrator of the User Name Mapping computer. You cannot use mapadmin to set up mappings for PCNFS users and groups on a remote computer.
  • The refresh interval determines how often User Name Mapping will refresh password and group information from the NIS server or from the PCNFS passwd and group files.

Related Topics

To configure simple maps

To create advanced maps for users

To create advanced maps for groups

mapadmin

Setting up User Name Mapping

Controlling access to User Name Mapping


Configure simple maps

To configure simple maps

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. Click the Maps tab, and then select Simple maps.
  4. Select the Windows domain for which you are creating a simple map.
  5. If you are creating a simple map using Network Information Service (NIS) data, in the NIS domain name box, type the name of the NIS domain. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, then in the NIS Server name box, type the name of the master server, and then click OK.
  6. To add another simple map between a Windows and an NIS domain, click Add
  7. To remove a simple map between a Windows and an NIS domain, select the map, and then click Remove.
  8. To reposition a simple map between a Windows and an NIS domain in the list, select the map, and then click Move up or Move down.
  9. To save the settings, click Apply.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.

  • You can create multiple simple maps between Windows and NIS domains. Maps are evaluated from the top of the list of maps to the bottom.

Using a command line

  • At a command prompt, type one of the following:

    • To supply required information for PCNFS authentication, type:

    mapadmin [computername] [–u user] [–p password] adddomainmap –d ntDomain –f Passwd/GroupDirectory

    To supply required information for Network Information Service (NIS) authentication, type:

    mapadmin [computername] [–u user] [–p password] adddomainmap –d ntDomain –y nisDomain

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative privileges on the computer, if different from the current user.
password | The password for the person who has administrative privileges on the computer, if different from the current user.
ntDomain | The name of the Windows domain.
Passwd/GroupDirectory | The fully qualified path of the directory on the User Name Mapping computer where the passwd and group files are located.
nisDomain | The name of the NIS domain.

Note

  • PCNFS passwd and group files must be located on a hard drive on the computer running User Name Mapping. Typically, these files are copied from a PCNFS server and are periodically updated by the administrator of the User Name Mapping computer.

Related Topics

To configure User Name Mapping

Administering User Name Mapping

Simple and advanced maps

To create advanced maps for users

To create advanced maps for groups

mapadmin


Remove a simple map

To remove a simple map

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping,
  3. Do one of the following:
    • To remove (disable) simple maps, click the Maps tab, and then click Simple maps.
    • To remove a specific Network Information Service (NIS) map, click Network Information Service (NIS), click the Maps tab, in the list below Simple maps, click the map you want to remove, and then click Remove.
  4. To save the settings, click Apply.

Note

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.

Using a command line

  • To remove a specific map between a Windows domain and an NIS domain, at a command prompt, type:

    mapadmin [computername] [–u user] [–p password] removedomainmap –d windowsdomain –y nisdomain

  • To remove all simple maps, at a command prompt, type:

    mapadmin [computername] [–u user] [–p password] removedomainmap -all

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative permissions on the computer, if different from the current user.
password | The password for the person who has administrative permissions on the computer, if different from the current user.
windowsdomain | The Windows domain of the map to be deleted.
nisdomain | The nisdomain of the map to be deleted.
-all | Deletes all simple maps.

Related Topics

Simple and advanced maps


Create advanced maps for users

To create advanced maps for users

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. Click the Maps tab, and then click Show User Maps.
  4. In the Windows domain name list, click the domain for which you want to list users, and then click List Windows Users.
  5. If you are obtaining UNIX user information from an Network Information Service (NIS) domain, in the NIS Domain name box, type the name of the NIS domain from which you are getting account information. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, then in the NIS Server name box, type the name of the master server.
  6. Click List UNIX Users.
  7. In the Windows Users and UNIX Users lists, click the two users you want to map to each other, and then click Add.
  8. To save the settings, click Apply.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.
  • As you add maps, new maps are listed below existing maps. This does not reflect the order in which the maps are evaluated, however. To view the actual order, click Apply, press F5 to refresh the User Name Mapping page, and then reopen the list of advanced maps. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, select a map and then click Move up or Move down to reposition the map within the list.

Using a command line

  • At a command prompt, type:

    mapadmin [computername] [–u user] [–p password] add –wu WindowsDomain\Username –uu username [–setprimary]

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative permissions on the computer, if different from the current user.
password | The password for the person who has administrative permissions on the computer, if different from the current user.
WindowsDomain\Username | The name of the Windows user.
–setprimary | Make this the primary mapping.
username | The name of the UNIX user, specified as domain\username or domain@username, where domain is either the name of the Network Information Service (NIS) domain or PCNFS.

Notes

  • The command-line method maps one pair of users or groups at a time. To map more users or groups, repeat the command.
  • When you use mapadmin to create multiple maps for a UNIX user, use the –setprimary option to specify the primary map. If necessary, you can use the mapadmin setprimary command later to change the primary map.
  • Maps cannot be evaluated in the order in which they are created. Primary maps are always evaluated before secondary maps. For information about how to view maps and change the order in which secondary maps are evaluated, see Related Topics.

Related Topics

To view maps

Administering User Name Mapping

Simple and advanced maps

To configure simple maps

To create advanced maps for groups

mapadmin


Create advanced maps for groups

To create advanced maps for groups

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. Click the Maps tab, and then click Show Group Maps.
  4. In the Windows domain name list, click the domain for which you want to list groups, and then click the List Windows Groups button.
  5. If you are obtaining UNIX group information from a Network Information Service (NIS) domain, in the NIS Domain name box, type the name of the NIS domain from which you are getting account information. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, in the NIS Server name box, type the name of the master server.
  6. Click the List UNIX Groups button.
  7. In the Windows Groups and UNIX Groups lists, click the two groups you want to map to each other, and then click Add.
  8. To save the settings, click Apply.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.
  • As you add maps, new maps are listed below existing maps. This does not reflect the order in which the maps are evaluated, however. To view the actual order, click Apply, press F5 to refresh the User Name Mapping page, and then reopen the list of advanced maps. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, select a map and then click Move up or Move down to reposition the map within the list.
  • You cannot create an advanced map for groups when administering a remote computer.

Using a command line

  • At a command prompt, type:

    mapadmin [computername] [–u user] [–p password] add –wg WindowsDomain\GroupName –ug groupname [–setprimary]

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative privileges on the computer, if different from the current user.
password | The password for the person who has administrative privileges on the computer, if different from the current user.
WindowsDomain\GroupName | The name of the Windows group.
–setprimary | Make this the primary mapping.
NTDomain\GroupName | The name of the Windows group.
groupname | The name of the UNIX group, specified as domain\groupname or domain@groupname, where domain is either the name of the Network Information Service (NIS) domain or PCNFS.

Notes

  • The command-line method maps one pair of users or groups at a time. To map more users or groups, repeat the command.
  • When you use mapadmin to create multiple maps for a UNIX group, use the –setprimary option to specify the primary map. If necessary, you can use the mapadmin setprimary command later to change the primary map.
  • Maps cannot be evaluated in the order in which they are created. Primary maps are always evaluated before secondary maps. For information about how to view maps and and change the order in which secondary maps are evaluated, see Related Topics.
  • You cannot create an advanced map for groups when administering a remote computer.

Related Topics

To view maps

Administering User Name Mapping

Simple and advanced maps

To configure simple maps

To create advanced maps for users

mapadmin


View maps

To view maps

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping, and then click the Maps tab.
  3. Click Show User Maps or Show Group Maps, depending on the kind of maps you want to view.
  4. To view simple maps, select Display simple maps in Mapped users list or Display simple maps in Mapped groups list.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.
  • Maps are displayed in the Mapped users and Mapped groups lists in the order in which the maps are evaluated. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, select a map and then click Move up or Move down to reposition the map within the list.

Using a command line

  • At a command prompt, type one of the following:

    mapadmin [computername] [–u user] [–p password] list {–all|–advanced|–simple}

    mapadmin [computername] [–u user] [–p password] list –wu WindowsUserName

    mapadmin [computername] [–u user] [–p password] list –uu unixUserName

    mapadmin [computername] [–u user] [–p password] list –wg WindowsGroupName

    mapadmin [computername] [–u user] [–p password] list –ug unixGroupName

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative privileges on the computer, if different from the current user.
password | The password for the person who has administrative privileges on the computer, if different from the current user.
–all | View details of both simple and advanced maps.
–advanced | View all advanced maps for users and groups.
–simple | View the simple-mapped domains.
WindowsUserName | The Windows user for which you want to see details.
unixUserName | The UNIX user for which you want to see details.
WindowsGroupName | The Windows group for which you want to see details.
unixGroupName | The UNIX group for which you want to see details.

Note

  • Maps are displayed in the order in which the maps are evaluated. Primary maps are always listed and evaluated first, followed by secondary maps. You can use the Windows interface to change the order in which secondary maps are evaluated. For information on how to do this, see "Using the Windows interface" in this topic.

Related Topics

mapadmin

Simple and advanced maps


Remove an advanced map

To remove an advanced map

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping, and then click the Maps tab.
  3. To remove a user map, click Show User Maps. To remove a group map, click Show Group Maps.
  4. In the Mapped Users or Mapped Groups list, click the map you want to remove, and then click Remove.
  5. To save the settings, click Apply.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.
  • You cannot delete a primary map if a secondary maps exists for the same user.

Using a command line

  • At a command prompt, do one of the following:

    To delete a user mapping, type:

    mapadmin [computername] [–u user] [–p password] delete [-wu user] [-uu user]

    To delete a group mapping, type:

    mapadmin [computername] [–u user] [–p password] delete [-wg group] [-ug group]

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative permissions on the computer, if different from the current user.
password | The password for the person who has administrative permissions on the computer, if different from the current user.
-wu user | The Windows user for whom the mapping will be deleted, specified as WindowsDomain\UserName.
-wg group | The Windows group for which the mapping will be deleted, specified as WindowsDomain\GroupName.
-uu user | The UNIX user for whom the mapping will be deleted, specified as domain\username or domain@username, where domain is either the name of the Network Information Service (NIS) domain or PCNFS. You must specify either the -wu or the -uu option, or both. If you specify both options, the particular mapping identified by the two options will be deleted. If you specify only the -uu option, all mappings for the specified user will be deleted.
-ug group | The UNIX group for which the mapping will be deleted, specified as domain\groupname or domain@groupname, where domain is either the name of the NIS domain or PCNFS. You must specify either the -wg or the -ug option, or both. If you specify both options, the particular mapping identified by the two options will be deleted. If you specify only the -ug option, all mappings for the specified group will be deleted.

Note

  • You cannot delete a primary map if a secondary maps exists for the same user.

Related Topics

Simple and advanced maps


Set the refresh interval for maps

To set the refresh interval for maps

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. Click the Configuration tab.
  4. In Days, Hours, and Minutes, type the refresh interval in hours and minutes. The minimum interval is five minutes.
  5. To save the settings, click Apply.

Note

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.

Using a command line

  • At a command prompt, type:

    mapadmin [computername] [–u user] [–p password] config –r [[days:]hh:]mm

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative permissions on the computer, if different from the current user.
password | The password for the person who has administrative permissions on the computer, if different from the current user.
dddd:hh:mm | The refresh interval for updating from the Windows and Network Information Service (NIS) databases in days, hours, and minutes. The minimum interval is five minutes.

Related Topics

mapadmin

Setting up User Name Mapping


Refresh data now

To refresh data now

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. On the Configuration tab, click Synchronize Now.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.

  • There is no command-line method for this procedure.


Back up and restore maps

To back up and restore maps

Using the Windows interface

  1. Open Microsoft Services for Network File System Administration.
  2. Click User Name Mapping.
  3. Click the Map Maintenance tab, and do one of the following:
    • To back up maps, in the first box, type the fully qualified path and name of the file to which you want to back up the maps, or click Browse to find the file. When you have identified or found the file, click Back Up.
    • To restore maps, in the second box, type the path and name of the file from which you want to restore maps, or click Browse to find the file. When you have identified or found the file, click Restore.

Notes

  • To open Microsoft Services for Network File System Administration, click Start, point to All Programs, point to Microsoft Services for NFS, and then click Microsoft Services for NFS Administration.
  • The following settings and maps are backed up:
    • Configuration type (Network Information Service [NIS] or PCNFS)
    • Domain maps
    • Advanced user and group maps
    • passwd and group files, if applicable
  • If you back up settings and maps on a remote computer configured to use PCNFS source files, the passwd and group maps are not backed up.
  • If you restore settings and maps on the same computer on which they were backed up, and if the computer is configured to use PCNFS source files, the restored passwd and group files will be placed in the %sfudir%\PCNFS directory and User Name Mapping will be configured to use the maps in that location.
  • If you are using PCNFS passwd and group files as the source for UNIX user and group names, and if you are running User Name Mapping in a server cluster or a server pool, you must perform the following tasks after restoring maps:
    • You must copy the restored passwd and group files to the appropriate directories on all nodes in the cluster or pool. On a server cluster, the files must be copied to directories with identical path names on each node in the cluster. The restored files will be located in %sfudir%\PCNFS or, if you restored the maps backed up on a remote computer in the cluster or pool, in %sfudir%\log of the remote computer.
    • After copying the files on a server pool, you must configure each node in the pool to use the files in the directories where you copied the files.
    • After copying the files on a server cluster, you must configure User Name Mapping on one node to use the files in the directory where you copied the files, and then click Apply. This will cause the updated settings to be replicated to other nodes in the cluster.

Using a command line

  • To create a backup file and perform the backup, at a command prompt, type:

    • mapadmin [computername] [–u user] [–p password] backup file

  • To restore, at a command prompt, type:

    • mapadmin [computername] [–u user] [–p password] restore file

Argument | Description
computername | The name of the computer you want to manage.
user | The name of the user who has administrative privileges on the computer, if different from the current user.
password | The password for the person who has administrative privileges on the computer, if different from the current user.
file | The fully qualified path and name of the file to be used for backup.

Notes

  • The following settings and maps are backed up:
    • Configuration type (Network Information Service [NIS] or PCNFS)
    • Domain maps
    • Advanced user and group maps
    • passwd and group files, if applicable
  • If you back up settings and maps on a remote computer configured to use PCNFS source files, the passwd and group maps are not backed up.
  • If you restore settings and maps on the same computer on which they were backed up, and if the computer is configured to use PCNFS source files, the restored passwd and group files will be placed in the %sfudir%\PCNFS directory and User Name Mapping will be configured to use the maps in that location.
  • If you are using PCNFS passwd and group files as the source for UNIX user and group names, and if you are running User Name Mapping in a server cluster or a server pool, you must perform the following tasks after restoring maps:
    • You must copy the restored passwd and group files to the appropriate directories on all nodes in the cluster or pool. On a server cluster, the files must be copied to directories with identical path names on each node in the cluster. The restored files will be located in %sfudir%\PCNFS or, if you restored the maps backed up on a remote computer in the cluster or pool, in %sfudir%\log of the remote computer.
    • After copying the files on a server pool, you must configure each node in the pool to use the files in the directories where you copied the files.
    • After copying the files on a server cluster, you must configure User Name Mapping on one node to use the files in the directory where you copied the files, and then repeat the restore operation with the same files on the other node. This will cause the updated settings to be replicated to other nodes in the cluster.

Related Topics

mapadmin

Administering User Name Mapping

Running User Name Mapping on a server cluster

Creating a User Name Mapping server pool


Concepts

This section provides general background information about User Name Mapping.

  • Understanding User Name Mapping
  • Simple and advanced maps
  • Setting up User Name Mapping
  • Administering User Name Mapping
  • Controlling access to User Name Mapping
  • Creating a User Name Mapping server pool
  • Running User Name Mapping on a server cluster


Understanding User Name Mapping

User Name Mapping acts as a single clearinghouse that provides centralized user mapping services for Server for NFS.

User Name Mapping lets you create maps between Windows and UNIX user and group accounts even though the user and group names in both environments may not be identical. Perhaps most important, User Name Mapping lets you maintain a single mapping database for the entire enterprise. This makes it easy to configure authentication for multiple computers running Microsoft Services for Network File System.

In addition to one-to-one mapping between Windows and UNIX user and group accounts, User Name Mapping permits one-to-many mapping. This lets you associate multiple Windows accounts with a single UNIX account. This can be useful, for example, when you do not need to maintain separate UNIX accounts for individuals and would rather use a few accounts to provide different classes of access permission.

You can use simple maps, which map Windows and UNIX accounts with identical names. You can also create advanced maps to associate Windows and UNIX accounts with different names, which you can use in conjunction with simple maps. For information about simple and advanced maps, see Simple and advanced maps.

User Name Mapping can obtain UNIX user, password, and group information from one or more Network Information Service (NIS) servers or from passwd and group files located on a local hard drive. The passwd and group files can be copied from a UNIX computer running the PCNFS daemon (PCNFSD) or a Windows computer running Server for PCNFS. See To configure User Name Mapping for more information about specifying the source for UNIX user information.

User Name Mapping periodically refreshes its mapping database from the source databases, ensuring that it is always kept up to date as changes occur in the Windows and UNIX name spaces. You can also refresh the database anytime you know the source databases have changed. For information on how to refresh the database automatically and manually, see To set the refresh interval for maps and To refresh data now.

You can back up and restore User Name Mapping data at any time. Because the database is backed up to a file, you can use that file to copy the mapping database to another server. This provides redundancy for the sake of fault tolerance. To learn how to back up and restore the mapping database, see To back up and restore maps.

If you obtain information from multiple NIS domains, it is assumed that each domain have unique users and user identifiers (UIDs). User Name Mapping does not perform any checks.


Simple and advanced maps

User Name Mapping can be used to map Windows and UNIX users to each other in a variety of ways. In a simple user map, users in a Windows domain are implicitly mapped one-to-one to UNIX users on the basis of user name. When the Windows domain and the UNIX passwd and group files or Network Information Service (NIS) domain are identified, User Name Mapping maps users and groups who have the same name in both the Windows and UNIX or NIS domain. If there is no match for a user or group name in either place, that user or group is not mapped to anything.

You can use advanced maps to set up one-to-one or many-to-one mappings between UNIX users and groups and Windows users and groups. For example, several Windows user names could be mapped to one UNIX user name, or several Windows groups could be mapped to a UNIX group. Advanced maps can also be used when the same person or group has different names on Windows and UNIX.

Once maps are set up, users can log on to Windows using their Windows user name and password, and can then access UNIX resources without having to supply a UNIX user name and password. User Name Mapping checks the authenticity of the Windows user and issues the appropriate user identifier (UID) and group identifier (GID) for use with the UNIX system.

Likewise, UNIX users can log on to their computers and then access Windows files, with User Name Mapping providing the credentials.

If the same user appears in both a simple and an advanced map, the advanced map is used for authentication.

You can use both NIS maps and PCNFS passwd and group files to create advanced maps, and you can create multiple simple maps between Windows domains and NIS domains. When using PCNFS passwd and group maps, however, you can only create a simple map between one Windows domain and one set of passwd and group files.

For information about creating simple and advanced maps, see To configure simple maps, To create advanced maps for users, and To create advanced maps for groups.

For information about administering User Name Mapping, see Administering User Name Mapping.


Setting up User Name Mapping

The primary setup required for User Name Mapping is the setting up of maps. You can create a simple map that associates Windows users with identically named UNIX users listed in passwd and group files copied from a PCNFS server or in Network Information Service (NIS) maps. You can also create advanced maps that associate Windows and UNIX users with different user names. For information about how to set up maps, see To configure User Name Mapping.

Note that User Name Mapping supports only passwd and group files; support for shadow files is not provided.

When setting up User Name Mapping, you can also set the refresh interval, which controls how often User Name Mapping refreshes its UNIX passwd and group information. For more information about setting the refresh interval, see To set the refresh interval for maps.


Administering User Name Mapping

The main administrative requirement for User Name Mapping is to update mappings when users are added or removed from Windows-based or UNIX-based computers. You can also use User Name Mapping to back up or restore mapping information to a file. In addition, you can use the backup and restore capabilities of User Name Mapping to transfer mapping information between computers that are both running User Name Mapping.

To administer User Name Mapping, using either the Windows interface or command-line methods, you must be logged on as a domain user belonging to the server Administrators group.

For background information about simple and advanced maps, see Simple and advanced maps.

For information on how to create simple and advanced maps, see To configure simple maps, To create advanced maps for users, and To create advanced maps for groups.


Controlling access to User Name Mapping

The authentication mechanism used by the network file system (NFS) protocol is based on trust relationships between host computers. That is, an NFS server accepts the user identifiers (UIDs) and group identifiers (GIDs) from a given client computer because the server is configured to recognize the client computer as trustworthy.

User Name Mapping acts as an intermediary between NFS servers and NFS clients on a network containing UNIX hosts and Windows computers. To maintain the implicit trust relationship between NFS client and host computers, it is essential that you control which computers can access User Name Mapping and hence act as a trusted host on the NFS network.

You control which computers can access User Name Mapping by editing a file named .maphosts in the %sfudir%\Mapper directory of the server running User Name Mapping. By adding entries in this file, you can easily permit or deny access by any other computer to User Name Mapping. If the .maphosts file is present but not empty, then only those computers allowed access by entries in the file can access User Name mapping. If the .maphosts file is present but empty (the default), no computers except the computer running User Name Mapping itself can access User Name Mapping. If the .maphosts file is not present, no computers can access User Name Mapping, including the computer running User Name Mapping itself.

The .maphosts file consists of a list of one or more of the elements described in the following table, each on a separate line. When matching a computer making a request against the elements in the list, User Name Mapping searches from the top down until it finds a match. Consequently, order is essential.

Element | Description
host | Specifies one or more computers that can access User Name Mapping. The host can be specified as an Internet Protocol (IP) address (IP version 4), or as a host name that resolves to one or more IP addresses.
host – | Specifies one or more computers that are denied access to User Name Mapping. The host can be specified as an IP address (IP version 4), or as a host name that resolves to one or more IP addresses. Note that there must be at least one blank space between host and the dash (–).
+ | Specifies that all computers can access User Name Mapping unless disallowed by an earlier entry in the list. All entries in the list following this element are ignored.
– | Specifies that all computers are disallowed access to User Name Mapping unless allowed by an earlier entry in the list. All entries in the list following this element are ignored.

The # character can be used to add comments to the file; everything on a line following the # character is ignored.

Access by the computer running User Name Mapping (localhost) is always allowed unless specifically denied in the .maphosts file, or the .maphosts file is not present. In case of a multihomed User Name Mapping server, access to the service running on other nodes from any of the nodes is also allowed, unless explicitly denied.

Examples

The following file allows access only by computers named mktg_nfs and sales_nfs:

mktg_nfs
sales_nfs
-

The following example file allows access by all computers except computers named rogue_host and hacker_wks:

rogue_host -
hacker_wks -
+

In the next example, rogue_host is denied access even though it appears in the list without a minus sign (–) because it follows a minus sign on its own line:

mktg_nfs
sales_nfs
-
rogue_host


Creating a User Name Mapping server pool

In larger networks, especially networks that extend across a wide area network (WAN) it is often desirable to run User Name Mapping on multiple computers. In the case of a WAN, running User Name Mapping on computers on the local area networks (LANs) as other computers running Microsoft Services for Network File System can help ensure a high level of performance. Even if your network is not geographically dispersed, you might want to run User Name Mapping on more than one computer to improve performance and availability.

When you run User Name Mapping on multiple computers, you can create a pool of servers using Domain Name System (DNS) round robin. Doing this provides a number of benefits:

  • Performance can be enhanced by locating computers running User Name Mapping near other computers running Microsoft Services for Network File System.
  • Load balancing can be achieved by alternating which servers respond to mapping requests
  • High availability can be ensured by providing redundant servers so that if one fails, other servers in the pool can continue to respond to mapping requests.

The first step in creating a User Name Mapping server pool is to install User Name Mapping on two or more servers. These servers must be configured and maintained identically to ensure that they provide consistent responses to mapping requests. The easiest way to do this is to use batch (.cmd) files that repeat the same mapadmin command for each server in the pool.

For example, you could install User Name Mapping on three servers named UNM1, UNM2, and UNM3. You would then create a batch file that would apply the same mapadmin command and arguments to all three servers:

REM POOLADMIN.CMD
REM Used to administer three User Name Mapping servers: UNM1, UNM2, and UNM3
REM Syntax: POOLADMIN mapadmin_argument[...]

mapadmin UNM1 %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 -u UNM1\administrator -p admUNM1pwd
mapadmin UNM2 %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 -u UNM2\administrator -p admUNM2pwd
mapadmin UNM3 %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 -u UNM3\administrator -p admUNM3pwd

Use a file like this, or a similar technique, to configure and administer all the User Name Mapping servers in the pool, both before and after the pool has been created.

Once you have set up and configured the servers that will belong to the pool, the next step is to create the pool itself. You do this by configuring a DNS server to map a single name to the Internet Protocol (IP) addresses of all three User Name Mapping servers. For example, you could map the name UNMpool to the IP addresses for UNM1, UNM2, and UNM3. Whenever a client computer asks the DNS server to resolve the name UNMpool, the DNS server will return all three IP addresses, the first of which is the one most clients will use. Because the DNS server rotates (in a round-robin fashion) the order in which it returns the three IP addresses, this automatically provides for load balancing.

The final step in setting up a User Name Mapping pool is to configure computers on the network running Server for NFSto use the virtual server name of the pool (UNMpool in the example). Because the DNS server rotates the order of the IP addresses it returns when it resolves this name, each of these User Name Mapping clients will receive a different primary IP address than the one given to the previous client, thereby automatically providing load balancing among the three User Name Mapping servers. In addition, these Microsoft Services for Network File System components are designed to send mapping requests to each IP address it receives if requests to the previous IP address times out. This provides for automatic failover if one of the servers in the pool should fail.

As noted earlier, it is essential that all servers that belong to a pool are configured and maintained identically. If PCNFS passwd and group files are used to provide UNIX account information for mapping users, for example, identical passwd and group files must be copied to and maintained on all servers in the pool, and if you restore data from a backup file, the passwd and group files that are restored to the %sfudir%\PCNFS or %temp% directory must be copied to the appropriate location for all servers in the pool. (Note that when files are restored on the computer from which they were backed up, the passwd and group files are restored to %sfudir%\PCNFS, regardless of their original location, and User Name Mapping is configured to use the files at that location.) Similarly, if you use .maphosts files to control access to servers in the pool, you must maintain identical .maphosts files on all servers in the pool.


Running User Name Mapping on a server cluster

A server cluster is a group of independent computer systems, known as nodes, working together as a single system to ensure that mission-critical applications and resources remain available to clients. Every node is attached to one or more cluster storage devices. Clustering allows users and administrators to access and manage the nodes as a single system rather than as separate computers.

User Name Mapping is specifically designed to make use of the server cluster and the server cluster's ability to replicate configuration settings among its nodes. This means that when User Name Mapping is installed on the nodes of a cluster, all changes to the configuration of User Name Mapping on one node are automatically replicated to User Name Mapping on all other nodes of the cluster. Consequently, you can manage User Name Mapping on all the nodes in the cluster simply by administering User Name Mapping on any one node. This ensures that user and group mappings and other settings will be identical on all servers in the cluster, thereby allowing you to easily achieve static load balancing by distributing User Name Mapping clients among the nodes of the cluster.

When you install User Name Mapping on a cluster, you should perform the following steps:

  1. To achieve static load balancing, create one cluster group for each node with its own Internet Protocol (IP) address and network name resource, and assign the preferred owner for each group so that it is primarily owned by a different node
  2. Install User Name Mapping on the nodes of the cluster one at a time. Before installing User Name Mapping on a node, move all groups away from the node.
  3. When User Name Mapping has been installed on all nodes, return all groups to their primary owners.
  4. Configure User Name Mapping on any node. Settings changed on one node are automatically replicated to all other nodes in the cluster.
  5. Configure each client computer to use the virtual server name from one of the cluster groups as its User Name Mapping server. This will ensure that client computers will continue to be served by User Name Mapping in case of node failure. To provide static load balancing, evenly distribute clients among the virtual servers of the cluster.

Notes

  • To run User Name Mapping on a server cluster, you must install User Name Mapping on the nodes of an existing cluster. Adding a stand-alone computer that is already running User Name Mapping as a new node in an existing cluster is not supported.
  • When running User Name Mapping on a server cluster, do not create maps using local Windows user and group accounts. Because the security identifiers (SIDs) of local accounts are recognized only by the server where those accounts were created, other nodes in the cluster will not be able to resolve those accounts when the server fails. Instead, you should create maps using domain accounts only.
  • If the cluster service is restarted on a node, you must also restart the User Name Mapping service. Until you do, configuration changes will not be replicated to and from User Name Mapping on the node.
  • User Name Mapping configuration changes are not properly replicated among nodes in a cluster if you run Microsoft Services for Network File System Administration or mapadmin on a computer that belongs to a domain that is not trusted by the domain of the cluster. To ensure that User Name Mapping configuration changes are properly replicated, always administer User Name Mapping running on a cluster using a computer that belongs to a trusted domain.
  • You must maintain identical .maphosts files on all servers in the pool. For more information about the .maphosts file, see Controlling access to User Name Mapping.
  • If you use PCNFS passwd and group files to provide user and group information for User Name Mapping running on a cluster, the passwd and group files must be located on local disk drives on each node, and the system administrator must update these files as required. In addition, if you restore mapping settings from a backup file, you must also copy the passwd and group files that are restored to the %sfudir%\PCNFS directory to the appropriate location on all of the nodes in the cluster and ensure that all nodes in the cluster are configured to use passwd and group files located in the same local path. (Note that when files are restored on the computer from which they were backed up, the passwd and group files are restored to %sfudir%\PCNFS, regardless of their original location, and User Name Mapping is configured to use the files at that location.) For more information about backing up and restoring User Name Mapping data, see To back up and restore maps.
  • If you are running User Name Mapping as well as Server for NFS on a server cluster, configure each node of the cluster to use localhost as its User Name Mapping server. For more information, see To set up authentication.


Troubleshooting

What problem are you having?

Unable to download Windows users from a Windows domain.

Cause: You do not have adequate privileges, or the computer running User Name Mapping does not belong to a domain trusted by the Windows-user domain.

Solution: Log on as a user in a domain trusted by the domain to which the computer running User Name Mapping belongs and that belongs to the Administrators group on the computer running User Name Mapping.

Unable to download Windows users from an Active Directory domain.

Cause: When installing the Active Directory domain controller, you chose the Permissions compatible with Windows 2000 Server option.

Solution: Do one of the following:

  • If the computer running User Name Mapping is a member of the domain, add the computer to the security group Pre-Windows 2000 Compatible Access.
  • If the computer running User Name Mapping does not belong to the domain (that is, it belongs to a trusted domain), add the special group Everyone to the Pre-Windows 2000 Compatible Access security group of the Active Directory domain.

You must restart the domain controller after adding the computer or group to the security group.

If, for some reason, you cannot add Everyone or the computer or running User Name Mapping to the Pre-Windows 2000 Compatible Access security group, you can enable User Name Mapping to enumerate users in the domain by running the User Name Mapping service with an account that belongs to the Domain Admins group. This method is less secure than the other two solutions, however, and should be avoided if possible.

Unable to download UNIX users from a Network Information Service (NIS) server.

Cause: You have specified only the domain name, and either the NIS server is on a different subnet, or the NIS server is down.

Solution: Ensure that the NIS server is running. Ensure that the computer running User Name Mapping and the NIS server are on the same subnet, or specify the Internet Protocol (IP) address of the NIS server.

Users of a particular Windows computer cannot access network file system (NFS) shares.

Cause: The Windows computer is not granted access in the .maphosts file to User Name Mapping.

Solution: Add the Windows computer to the .maphosts file. Make sure it does not appear after any – entry.

Mapped users cannot access NFS resources.

Cause: The .maphosts file has not been modified to specify trusted computers.

Solution: Ensure that the .maphosts file specifies the names or Internet Protocol (IP) addresses of computers that can map user accounts by using User Name Mapping. For more information, see Controlling access to User Name Mapping.

If users still cannot access NFS resources, see "Error message: Unable to perform the requested operation as the mapping service cannot be contacted" later in this topic.

Error message: Unable to perform the requested operation as the mapping service cannot be contacted.

Cause: The maximum number of concurrent client connections has been exceeded.

Solution: If message appears frequently when you are attempting to administer User Name Mapping, or if properly mapped users cannot access NFS resources intermittently and other troubleshooting steps have failed, you can increase the maximum number of concurrent client connections that are allowed by creating a DWORD registry value named RpcMaxConcurrentConnectionsPerIp in the following location:

HKEY_LOCAL_MACHINE\CurrentControlSet\Services\RpcXdr\Parameters

The value must be between 16 (the default) and 64.

If the problem persists, or if NFS access performance noticeably degrades, consider establishing a User Name Mapping server pool. See Creating a User Name Mapping server pool for more information.

If you click Reload immediately after creating and saving a map, the new map is not shown.

Cause: Maps are saved to the registry, which notifies User Name Mapping of the new map. Because this process can take a minute or more, if you click Reload during that time, you will not see current data.

Solution: Wait at least a minute, and then click Reload again.

A user is unable to access NFS resources after being added or changed.

Cause: Maps have not been refreshed with new or changed data in the Windows or UNIX user databases.

Solution: After adding or changing a user in the Windows domain, the Network Information Service (NIS) domain, or the PCNFS files, update User Name Mapping. On the Configuration tab, click Synchronize Now, and then click Apply.

User Name Mapping configuration settings are not replicated across nodes in a server cluster.

Cause: The cluster service is not running, was not running when User Name Mapping started, or failed after User Name Mapping started.

Solution: Stop User Name Mapping, start the cluster service if needed, and then restart User Name Mapping.

If replication consistently fails after the computer restarts, it might be because User Name Mapping is starting before the cluster service completes its start-up procedures. In this case, use the Windows Services manager to make User Name Mapping dependent on the cluster service.

Restoring PCNFS maps on a server cluster node does not recreate maps on other nodes.

Cause: This is by design. User Name Mapping restores PCNFS files to the %sfudir%\PCNFS directory on one node only.

Solution: Copy the files in %sfudir%\PCNFS to the same location on all other cluster server nodes.

Maps are not updated to reflect changes in Windows user and group accounts or in NIS or PCNFS databases.

Cause: User Name Mapping server has not received the changes. By default, User Name Mapping refreshes its maps once every 60 minutes.

Solution: In Microsoft Services for Network File System Administration, click User Name Mapping, click Map Maintenance, and then click Synchronize Now.