idmap_nss — Samba's idmap_nss Backend for Winbind
The idmap_nss plugin provides a means to map Unix users and groups to Windows accounts and obsoletes the "winbind trusted domains only" smb.conf option. This provides a simple means of ensuring that the SID for a Unix user named jsmith is reported as the one assigned to DOMAIN\jsmith which is necessary for reporting ACLs on files and printers stored on a Samba member server.
This example shows how to use idmap_nss to check the local accounts for its own domain while using allocation to create new mappings for trusted domains
[global] idmap config * : backend = tdb idmap config * : range = 1000000-1999999 idmap config SAMBA : backend = nss idmap config SAMBA : range = 1000-999999