User name mapping performs one-to-many mappings in a single direction only (269736)

MORE INFORMATION

You can map a Windows-based account to a single UNIX-based account, but not the reverse. When you map a Windows-based account to a UNIX-based account, it cannot be mapped to any other UNIX-based account, but you can only map the same UNIX-based account to multiple Windows-based accounts in one direction. The following illustration clarifies this behavior:

Illustration 1a: Mapping multiple Windows users to a single UNIX account (valid)

Windows Users	UNIX Users
User-A	account1
User-B	account1
User-C	account1

Illustration 1b: Mapping multiple Windows groups to a single UNIX group (valid)

Windows Groups	UNIX Groups
Group-A	group1
Group-B	group1
Group-C	group1

The following illustrations demonstrate what you cannot do:

Illustration 2a: Mapping Multiple UNIX accounts to a single Windows user (invalid)

Windows Users	UNIX Users
User-A	account1
User-A	account2
User-A	account3

Illustration 2b: Mapping multiple UNIX groups to a single Windows group (invalid):

Windows Groups	UNIX Groups
Group-A	group1
Group-A	group2
Group-A	group3

This behavior is by design. The group or user to which you are mapping contains the User Identifier (UID) or Group Identifier (GID) that you want to impersonate.

Note You cannot map one-to-many relationships from a UNIX-based computer to a Windows-based computer.

When you map multiple Windows users or groups to a single UNIX user or group, you have to designate one of mappings as primary. This primary mapping is used when the UNIX account or group is mapped back to a Windows account or group. For example, this mapping is used when a UNIX client uses NFS to write a file. By default, the first mapping that is created is automatically designated as the primary mapping. To set a different mapping as the primary mapping, use the Services for UNIX administration console. Or, use the -setprimary flag with the Mapadmin.exe file when you create the mapping.