IDMAP\_SSS(8) SSSD Manual pages IDMAP\_SSS(8)

.SH "NAME" idmap\_sss - SSSD's idmap\_sss Backend for Winbind

.SH "DESCRIPTION"

.PP The idmap\_sss module provides a way to call SSSD to map UIDs/GIDs and SIDs. No database is required in this case as the mapping is done by SSSD.

.SH "IDMAP OPTIONS"

.PP range = low - high

Defines the available matching UID and GID range for which the backend is authoritative.

.RE

.SH "EXAMPLES"

.PP This example shows how to configure idmap\_sss as the default mapping module.

```
[global]
security = ads
workgroup = <AD-DOMAIN-SHORTNAME>
idmap config <AD-DOMAIN-SHORTNAME> : backend        = sss
idmap config <AD-DOMAIN-SHORTNAME> : range          = 200000-2147483647
idmap config * : backend        = tdb
idmap config * : range          = 100000-199999


        
```

.PP Please replace &lt;AD-DOMAIN-SHORTNAME&gt; with the NetBIOS domain name of the AD domain. If multiple AD domains should be used each domain needs an idmap config line with backend = sss and a line with a suitable range.

.PP Since Winbind requires a writeable default backend and idmap\_sss is read-only the example includes backend = tdb as default.

.SH "SEE ALSO"

.PP [**sssd**(8)](/man/enterprise-packages/sssd-fips/sssd.8), [**sssd.conf**(5)](/man/enterprise-packages/sssd-fips/sssd.conf.5), [**sssd-ldap**(5)](/man/enterprise-packages/sssd-fips/sssd-ldap.5), [**sssd-ldap-attributes**(5)](/man/enterprise-packages/sssd-fips/sssd-ldap-attributes.5), [**sssd-krb5**(5)](/man/enterprise-packages/sssd-fips/sssd-krb5.5), [**sssd-simple**(5)](/man/enterprise-packages/sssd-fips/sssd-simple.5), [**sssd-ipa**(5)](/man/enterprise-packages/sssd-fips/sssd-ipa.5), [**sssd-ad**(5)](/man/enterprise-packages/sssd-fips/sssd-ad.5), [**sssd-sudo**(5)](/man/enterprise-packages/sssd-fips/sssd-sudo.5), [**sssd-session-recording**(5)](/man/enterprise-packages/sssd-fips/sssd-session-recording.5), [**sss\_cache**(8)](/man/enterprise-packages/sssd-fips/sss_cache.8), [**sss\_debuglevel**(8)](/man/enterprise-packages/sssd-fips/sss_debuglevel.8), [**sss\_obfuscate**(8)](/man/enterprise-packages/sssd-fips/sss_obfuscate.8), [**sss\_seed**(8)](/man/enterprise-packages/sssd-fips/sss_seed.8), [**sssd\_krb5\_locator\_plugin**(8)](/man/enterprise-packages/sssd-fips/sssd_krb5_locator_plugin.8), [**sss\_ssh\_authorizedkeys**(1)](/man/enterprise-packages/sssd-fips/sss_ssh_authorizedkeys.1), [**sss\_ssh\_knownhosts**(1)](/man/enterprise-packages/sssd-fips/sss_ssh_knownhosts.1), [**sssd-ifp**(5)](/man/enterprise-packages/sssd-fips/sssd-ifp.5), [**pam\_sss**(8)](/man/enterprise-packages/sssd-fips/pam_sss.8). [**sss\_rpcidmapd**(5)](/man/enterprise-packages/sssd-fips/sss_rpcidmapd.5)

# [AUTHORS](#AUTHORS)

**The SSSD upstream - https://github.com/SSSD/sssd/**

10/11/2026 SSSD

---

Document: idmap_sss(8) from sssd-fips 2.13.1-r2 (Chainguard OS)