Integrating UNIX into Windows NT
4-9
Compaq Confidential – Need to Know Required
Writer:
Doug Warren
Project:
Compaq TaskSmart N2400 Administration Guide
Comments:
Part Number:
177675-002
File Name:
e-ch4.doc
Last Saved On:
2/9/01 12:45 PM
User Name Mapping
Another component of SFU is the User Name Mapping Server. This section
defines and describes the purpose of user name mapping.
User name mapping is the process of taking user and group identification from
one environment and translating it into user identification in another
environment.
In the context of UNIX and NFS, user and group identification is a
combination of a user ID (UID) and group ID (GID). In Windows
environments, a user identification is a Security ID (SID) or Globally Unique
Identifier (GUID) for Windows 2000.
When a fileserver is exporting files within a homogeneous environment, there
are no problems with authentication. It is a simple matter of making a direct
comparison to determine whether the user should be allowed access to the file,
and what level of access to allow.
However, when a fileserver is working in a heterogeneous environment, some
method of translating user access is required. User mapping is the process of
translating the user security rights from one environment to another.
As described in the previous section, the NFS server grants or denies access to
the export based on machine name or IP address. However, once the client
machine has access to the export, user-level permissions are used to grant or
deny access to user files and directories.
The TaskSmart N2400 appliance is capable of operating in a heterogeneous
environment, meaning that it is able to work with both UNIX and Windows
clients. Because the files are stored in the native Windows NT file system, the
server has to map the UNIX users to Windows users to determine the user
access level of the files.
NOTE:
User mapping is not designed to address existing user database problems in the
existing environment. All UIDs and GIDs must be unique across all NIS (Network
Information Service) domains and all user names must be unique across all Windows NT
domains.
