Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 37. Using ID views for Active Directory users

You can use ID views to specify new values for the POSIX attributes of your Active Directory (AD) users in an IdM-AD Trust environment.

By default, IdM applies the Default Trust View to all AD users. You can configure additional ID views on individual IdM clients to further adjust which POSIX attributes specific users receive.

37.1. How the Default Trust View works

The Default Trust View is the default ID view that is always applied to AD users and groups in trust-based setups. It is created automatically when you establish the trust using the ipa-adtrust-install command and cannot be deleted.

Note

The Default Trust View only accepts overrides for AD users and groups, not for IdM users and groups.

Using the Default Trust View, you can define custom POSIX attributes for AD users and groups, thus overriding the values defined in AD.

Table 37.1. Applying the Default Trust View
 Values in ADDefault Trust ViewResult

Login

ad_user

ad_user

ad_user

UID

111

222

222

GID

111

(no value)

111

You can also configure additional ID Views to override the Default Trust View on IdM clients. IdM applies the values from the host-specific ID view on top of the Default Trust View:

  • If an attribute is defined in the host-specific ID view, IdM applies the value from this ID view.
  • If an attribute is not defined in the host-specific ID view, IdM applies the value from the Default Trust View.
Table 37.2. Applying a host-specific ID view on top of the Default Trust View
 Values in ADDefault Trust ViewHost-specific ID viewResult

Login

ad_user

ad_user

(no value)

ad_user

UID

111

222

333

333

GID

111

(no value)

333

333

Note

You can only apply host-specific ID views to override the Default Trust View on IdM clients. IdM servers and replicas always apply the values from the Default Trust View.

37.2. Defining global attributes for an AD user by modifying the Default Trust View

If you want to override a POSIX attribute for an Active Directory (AD) user throughout your entire IdM deployment, modify the entry for that user in the Default Trust View. This procedure sets the GID for the AD user ad_user@ad.example.com to 732000006.

Prerequisites

  • You have authenticated as an IdM administrator.
  • A group must exist with the GID or you must set the GID in an ID override for a group.

Procedure

  1. As an IdM administrator, create an ID override for the AD user in the Default Trust View that changes the GID number to 732000006: 

    # ipa idoverrideuser-add 'Default Trust View' ad_user@ad.example.com --gidnumber=732000006
    Copy to Clipboard

  2. Clear the entry for the ad_user@ad.example.com user from the SSSD cache on all IdM servers and clients. This removes stale data and allows the new override value to apply. 

    # sssctl cache-expire -u ad_user@ad.example.com
    Copy to Clipboard

Verification

  • Retrieve information for the ad_user@ad.example.com user to verify the GID reflects the updated value. 

    # id ad_user@ad.example.com
uid=702801456(ad_user@ad.example.com) gid=732000006(ad_admins)
groups=732000006(ad_admins),702800513(domain users@ad.example.com)
    Copy to Clipboard

37.3. Overriding Default Trust View attributes for an AD user on an IdM client with an ID view

You might want to override some POSIX attributes from the Default Trust View for an Active Directory (AD) user. For example, you might need to give an AD user a different GID on one particular IdM client. You can use an ID view to override a value from the Default Trust View for an AD user and apply it to a single host. This procedure explains how to set the GID for the ad_user@ad.example.com AD user on the client1.idm.example.com IdM client to 732001337.

Prerequisites

  • You have root access to the IdM client system.
  • You are logged in as a user with the required privileges, for example the admin user.

Procedure

  1. On the IdM server, create an ID view. For example, to create an ID view named example_for_client1: 

    $ ipa idview-add example_for_client1
---------------------------
Added ID View "example_for_client1"
---------------------------
  ID View Name: example_for_client1
    Copy to Clipboard

  2. On the IdM server, sdd a user override to the example_for_client1 ID view. To override the user’s GID:

    • Enter the ipa idoverrideuser-add command
    • Add the name of the ID view
    • Add the user name, also called the anchor
    • Add the --gidnumber= option: 
    $ ipa idoverrideuser-add example_for_client1 ad_user@ad.example.com --gidnumber=732001337
-----------------------------
Added User ID override "ad_user@ad.example.com"
-----------------------------
  Anchor to override: ad_user@ad.example.com
  GID: 732001337
    Copy to Clipboard

  3. On the IdM server, apply example_for_client1 to the client1.idm.example.com IdM client: 

    $ ipa idview-apply example_for_client1 --hosts=client1.idm.example.com
-----------------------------
Applied ID View "example_for_client1"
-----------------------------
hosts: client1.idm.example.com
---------------------------------------------
Number of hosts the ID View was applied to: 1
---------------------------------------------
    Copy to Clipboard
    Note

    The ipa idview-apply command also accepts the --hostgroups option. The option applies the ID view to hosts that belong to the specified host group, but does not associate the ID view with the host group itself. Instead, the --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them.

    This means that if a host is added to the host group in the future, the ID view does not apply to the new host.

  4. On the IdM client, clear the entry for the ad_user@ad.example.com user from the SSSD cache on the client1.idm.example.com IdM client. This removes stale data and allows the new override value to apply. 

    # sssctl cache-expire -u ad_user@ad.example.com
    Copy to Clipboard

Verification

  1. SSH to the client system as ad_user@ad.example.com: 

    # ssh ad_user@ad.example.com@client1.idm.example.com
    Copy to Clipboard

  2. On the client system, retrieve information for the ad_user@ad.example.com user to verify the GID reflects the updated value. 

    [ad_user@ad.example.com@client1 ~]$ id ad_user@ad.example.com
uid=702801456(ad_user@ad.example.com) gid=732001337(admins2)
groups=732001337(admins2),702800513(domain users@ad.example.com)
    Copy to Clipboard
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat