Yeah, so basically.  The client and the server both get the map.  The client sends the server inputs.  But it *also* moves the player, and checks that all of the things the server sends back match what it thought it was going to have to do.  If they don't, it throws out the predictions in favor of what the server says.  As you get replies from the server, you knock the interpolation points off the list of predictions the client made, and re-run your algorithm.  Lots of info on Google about this stuff under the terms client-side prediction and client-side interpolation, as previously stated.

It's okay if the client handles the map, if you're fine with the kinds of cheating that allows.  For example, if you're doing some sort of shooter where me and my friends all play together but we aren't playing with a bunch of strangers at the same time, then who cares?  If people don't want to play with cheaters they'll just not play with them.  The issue is when having an authoritative client opens up the ability for players to affect other players who aren't people you know, or in ways that affect the world permanently, because that's unfair since people can't just walk away from cheaters.