Chapter 38. Managing subID ranges manually
In a containerized environment, sometimes an IdM user needs to assign subID ranges manually. The following instructions describe how to manage the subID ranges.
38.1. Generating subID ranges using IdM CLI
As an Identity Management (IdM) administrator, you can generate a subID range and assign it to IdM users.
Prerequisites
- The IdM users exist.
-
You have obtained an IdM
adminticket-granting ticket (TGT). See Using kinit to log in to IdM manually for more details. -
You have
rootaccess to the IdM host where you are executing the procedure.
Procedure
Optional: Check for existing subID ranges:
# ipa subid-findIf a subID range does not exist, select one of the following options:
Generate and assign a subID range to an IdM user:
# ipa subid-generate --owner=idmuser Added subordinate id "359dfcef-6b76-4911-bd37-bb5b66b8c418" Unique ID: 359dfcef-6b76-4911-bd37-bb5b66b8c418 Description: auto-assigned subid Owner: idmuser SubUID range start: 2147483648 SubUID range size: 65536 SubGID range start: 2147483648 SubGID range size: 65536Generate and assign subID ranges to all IdM users:
# /usr/libexec/ipa/ipa-subids --all-users Found 2 user(s) without subordinate ids Processing user 'user4' (1/2) Processing user 'user5' (2/2) Updated 2 user(s) The ipa-subids command was successful
Optional: Assign subID ranges to new IdM users by default:
# ipa config-mod --user-default-subid=True
Verification
Verify that the user has a subID range assigned:
# ipa subid-find --owner=idmuser 1 subordinate id matched Unique ID: 359dfcef-6b76-4911-bd37-bb5b66b8c418 Owner: idmuser SubUID range start: 2147483648 SubUID range size: 65536 SubGID range start: 2147483648 SubGID range size: 65536 Number of entries returned 1
38.2. Generating subID ranges using IdM WebUI interface
As an Identity Management (IdM) administrator, you can generate a subID range and assign it to a user in the IdM WebUI interface.
Prerequisites
- The IdM user exists.
-
You have obtained an IdM
adminKerberos ticket (TGT). See Logging in to IdM in the Web UI: Using a Kerberos ticket for more details. -
You have
rootaccess to the IdM host where you are executing the procedure.
Procedure
- In the IdM WebUI interface expand the Subordinate IDs tab and choose the Subordinate IDs option.
- When the Subordinate IDs interface appears, click the Add button in the upper-right corner of the interface. The Add subid window appears.
- In the Add subid window choose an owner, that is the user to whom you want to assign a subID range.
- Click the Add button.
Verification
- View the table under the Subordinate IDs tab. A new record shows in the table. The owner is the user to whom you assigned the subID range.
38.3. Viewing subID information about IdM users by using IdM CLI
As an Identity Management (IdM) user, you can search for IdM user subID ranges and view the related information.
Prerequisites
- You have configured a subID range on the IdM client.
- You have obtained an IdM user ticket-granting ticket (TGT). See Using kinit to log in to IdM manually for more details.
Procedure
To view the details about a subID range:
If you know the unique ID hash of the Identity Management (IdM) user that is the owner of the range:
$ ipa subid-show 359dfcef-6b76-4911-bd37-bb5b66b8c418 Unique ID: 359dfcef-6b76-4911-bd37-bb5b66b8c418 Owner: idmuser SubUID range start: 2147483648 SubUID range size: 65536 SubGID range start: 2147483648 SubGID range size: 65536
If you know a specific subID from that range:
$ ipa subid-match --subuid=2147483670 1 subordinate id matched Unique ID: 359dfcef-6b76-4911-bd37-bb5b66b8c418 Owner: uid=idmuser SubUID range start: 2147483648 SubUID range size: 65536 SubGID range start: 2147483648 SubGID range size: 65536 Number of entries returned 1
38.4. Listing subID ranges using the getsubid command
As a system administrator, you can use the command-line interface to list the subID ranges of Identity Management (IdM) or local users.
Prerequisites
- The idmuser user exists in IdM.
-
The
shadow-utils-subidpackage is installed. -
You can edit the
/etc/nsswitch.conffile.
Procedure
Open the
/etc/nsswitch.conffile and configure theshadow-utilsutility to use IdM subID ranges by setting thesubidvariable to thesssvalue:[...] subid: sss
NoteYou can provide only one value for the
subidfield. Setting thesubidfield to thefilevalue or no value instead ofsssconfigures theshadow-utilsutility to use the subID ranges from the/etc/subuidand/etc/subgidfiles.List the subID range for an IdM user:
$ getsubids idmuser 0: idmuser 2147483648 65536The first value, 2147483648, indicates the subID range start. The second value, 65536, indicates the size of the range.
