Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I manage users using an OpenLDAP server. I now want to connect a NAS as the main file server using NFSv4. The NAS allows me to import LDAP users and groups, but it maps them to user@ldap.domain. So I must somehow explain NFS4 that user here is user@ldap.domain there. I believe that this is the task of idmapd, but reading the man pages and several howtos, I couldn't figure out how to actually do it.

Any pointer to useful practical examples is welcome.

Update: Having found a pointer to increase debugging vebosity: sysctl -w sunrpc.nfs_debug=1023 I figured out that idmapd tried to resolve user@ldap.domain@fqdn. Setting the domain parameter accordingly, resolves the right users. Obviously rpc.idmapd caches results even across restarts, which makes troubleshooting tedious.

So I think I've resolved the first issue. The next are

  • Mapping of exceptions: root is not on the LDAP and the group users also exists locally on the NAS, so these still map to nobody or nogroup
  • Finding an effective way to clear the cache. On the net I found claims about nfsidmap -c to do the job, but this results in an error telling that the id_resolver keyring was not found. Also, I did stop nscd.

Any pointer especially for the second item would be valuable.

share|improve this question
did you try to set in /etc/idmapd.conf domain = ldap.domain? – kofemann Oct 22 '13 at 13:55
yes, no change in the behavior. Unfortunately, rpc.idmapd -vvvvvvv -f does not provide any useful information about what it actually does. – Lars Hanke Oct 22 '13 at 14:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.