NAME

       nfsidmap - The NFS idmapper upcall program

SYNOPSIS

       nfsidmap [-v] [-t timeout] key desc
       nfsidmap [-v] [-c]
       nfsidmap [-v] [-u|-g|-r user]

DESCRIPTION

       The  file  /usr/sbin/nfsidmap is used by the NFS idmapper to translate user and group ids into names, and
       to translate user and group names into ids. Idmapper uses request-key to perform the upcall and cache the
       result.  /usr/sbin/nfsidmap is  called  by  /sbin/request-key,  and  will  perform  the  translation  and
       initialize a key with the resulting information.

       nfsidmap can also used to clear the keyring of all the keys or revoke one particular key.  This is useful
       when the id mappings have failed to due to a lookup error resulting in all the cached uids/gids to be set
       to the user id nobody.

OPTIONS

       -c     Clear the keyring of all the keys.

       -g user
              Revoke the gid key of the given user.

       -r user
              Revoke both the uid and gid key of the given user.

       -t timeout
              Set the expiration timer, in seconds, on the key.  The default is 600 seconds (10 mins).

       -u user
              Revoke the uid key of the given user.

       -v     Increases the verbosity of the output to syslog (can be specified multiple times).

CONFIGURING

       The  file  /etc/request-key.conf  will  need  to be modified so /sbin/request-key can properly direct the
       upcall. The following line should be added before a call to keyctl negate:

       create    id_resolver    *    *    /usr/sbin/nfsidmap -t 600 %k %d

       This will direct all id_resolver requests to the program /usr/sbin/nfsidmap.  The -t 600 defines how many
       seconds into the future the key will expire.  This is an optional parameter  for  /usr/sbin/nfsidmap  and
       will default to 600 seconds when not specified.

       The idmapper system uses four key descriptions:

              uid: Find the UID for the given user
              gid: Find the GID for the given group
             user: Find the user name for the given UID
            group: Find the group name for the given GID

       You can choose to handle any of these individually, rather than using the generic upcall program.  If you
       would like to use your own program for a uid lookup then you would edit your request-key.conf so it looks
       similar to this:

       create    id_resolver    uid:*     *    /some/other/program %k %d
       create    id_resolver    *         *    /usr/sbin/nfsidmap %k %d

       Notice  that  the  new  line was added above the line for the generic program.  request-key will find the
       first matching line and run the corresponding program.  In this case, /some/other/program will handle all
       uid lookups, and /usr/sbin/nfsidmap will handle gid, user, and group lookups.

AUTHOR

       Bryan Schumaker, <bjschuma@netapp.com>

                                                 1 October 2010                                      nfsidmap(5)