user mapping in security = domain mode

[Cole, Timothy D.]

How precisely does user mapping work with security = domain?  Can someone
either:

a. point me to documentation that describes the precise behavior, including
any implicit mappings done, precedence of mappings, what users with the same
username in different domains map to, and any other special cases.
smb.conf(5) does not do this.

b. the relevent areas of the source

Both would be nice, actually.