Chapter 37. Adjusting ID ranges manually

Procedure

1. To create a new IdM ID range, use the ipa idrange-add command. You must specify the new range name, the first ID number of the range, the range size, and the first RID number of the primary and secondary RID range:

   # ipa idrange-add IDM.EXAMPLE.COM_new_range --base-id 5000 --range-size 1000 --rid-base 300000 --secondary-rid-base 1300000
   
   ipa: WARNING: Service dirsrv@IDM-EXAMPLE-COM.service requires restart on IPA server <all IPA servers> to apply configuration changes.
   ------------------------------------------
   Added ID range "IDM.EXAMPLE.COM_new_range"
   ------------------------------------------
     Range name: IDM.EXAMPLE.COM_new_range
     First Posix ID of the range: 5000
     Number of IDs in the range: 1000
     First RID of the corresponding RID range: 300000
     First RID of the secondary RID range: 1300000
     Range type: local domain range

2. Restart the Directory Server service on all IdM servers in the deployment:

   # systemctl restart dirsrv@IDM-EXAMPLE-COM.service

   This ensures that when you create users with UIDs from the new range, they have security identifiers (SIDs) assigned.

3. Optional: Update the ID range immediately:

   1. Clear the System Security Services Daemon (SSSD) cache:

      # sss_cache -E

   2. Restart the SSSD daemon:

      # systemctl restart sssd

      Note

      If you do not clear the SSSD cache and restart the service, SSSD only detects the new ID range when it updates the domain list and other configuration data stored on the IdM server.

Procedure

1. Run ipa-idrange-fix to analyze the current ID ranges. You can customize this by using various options, such as:

   # ipa-idrange-fix --rangegap 300000 --minrange 20 --ridoffset 200000

   • --rangegap <value>: Specifies the maximum gap between IDs to be included in a single proposed range. The default is 200000.
   • --minrange <value>: Sets the minimum number of IDs required to form a valid new range. Any group of IDs smaller than this will be listed as outliers for manual resolution. The default is 10.

   • --ridoffset <value>: Sets an offset for new RID bases to allow for future expansion of existing ranges. The default is 100000.

     Note

     By default, the ipa-idrange-fix tool ignores users and groups with IDs below 1000, as these are typically reserved for system accounts. To include these entities in the analysis, which is not recommended, use the --allowunder1000 option.

2. The tool displays proposed changes, such as creating new ID ranges. Review the proposed changes carefully.

   Note

   ipa-idrange-fix does not create new SIDs for users and groups who do not have them. To create missing SIDs, see Enabling Security Identifiers (SIDs) in IdM.

3. Enter yes to apply the changes.

   Important

   Do not run ipa-idrange-fix with the --unattended option unless you are certain you want to automatically apply all proposed changes.

Verification

1. Review the log file to see the applied changes:

   # cat /var/log/ipa/ipa-idrange-fix.log

2. Use the ipa idrange-find --all command to verify that the new ID ranges have been created correctly:

   # ipa idrange-find --all
   
   ----------------
   2 ranges matched
   ----------------
   dn: cn=IDM.EXAMPLE.COM_id_range,cn=ranges,cn=accounts,dc=example,dc=com
   Range name: IDM.EXAMPLE.COM_id_range
   First Posix ID of the range: 882200000
   Number of IDs in the range: 200000
   First RID of the corresponding RID range: 1000
   First RID of the secondary RID range: 1000000
   Range type: local domain range
   ipaUniqueID: 569bf864-9d45-11ea-bea3-525400f6f085
   objectclass: ipaIdRange, top
   
   dn: cn=IDM.EXAMPLE.COM_new_id_range,cn=ranges,cn=accounts,dc=example,dc=com
   Range name: IDM.EXAMPLE.COM_new_id_range
   First Posix ID of the range: 12000000
   Number of IDs in the range: 200000
   First RID of the corresponding RID range: 10000
   First RID of the secondary RID range: 20000000
   Range type: local domain range
   ipaUniqueID: 7a2b3c4d-e5f6-7890-a1b2-c3d4e5f67890
   objectclass: ipaIdRange, top
   ----------------------------
   Number of entries returned 2
   ----------------------------

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create the idrange-present.yml playbook with the following content:

   ---
   - name: Playbook to manage idrange
     hosts: ipaserver
     become: no
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure local idrange is present
       ipaidrange:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: new_id_range
         base_id: 12000000
         range_size: 200000
         rid_base: 1000000
         secondary_rid_base: 200000000

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory idrange-present.yml

5. SSH to ipaserver and restart the Directory Server:

   # systemctl restart dirsrv@IDM.EXAMPLE.COM.service

   This ensures that when you create users with UIDs from the new range, they have security identifiers (SIDs) assigned.

6. Optional: Update the ID range immediately:

   1. On ipaserver, clear the System Security Services Daemon (SSSD) cache:

      # sss_cache -E

   2. On ipaserver, restart the SSSD daemon:

      # systemctl restart sssd

   Note

   If you do not clear the SSSD cache and restart the service, SSSD only detects the new ID range when it updates the domain list and other configuration data stored on the IdM server.

Procedure

1. Display all the ID ranges that are currently in use:

   [root@server ~]# ipa idrange-find

2. Identify the name of the ID range associated with the trust you have removed. The first part of the name of the ID range is the name of the trust, for example AD.EXAMPLE.COM_id_range.

3. Remove the range:

   [root@server ~]# ipa idrange-del AD.EXAMPLE.COM_id_range

4. Restart the SSSD service to remove references to the ID range you have removed.

   [root@server ~]# systemctl restart sssd

Procedure

1. Disable the subordinate ID feature:

   $ ipa config-mod --addattr ipaconfigstring=SubID:Disable

2. Remove any existing subordinate ID ranges:

   $ ipa idrange-del <id_range>

3. On the IdM server, ensure the internal DNA plugin configuration is correctly removed:

   # ipa-server-upgrade

4. Add a new local ID range that covers the 2^31 to 2^32-1 space. Ensure that you define RID bases for this new range so that IdM can generate SIDs properly for users and groups. For example:

   $ ipa idrange-add IDM.EXAMPLE.COM_new_range --base-id 2200000000 --range-size 200000 --rid-base 1000 --secondary-rid-base 2300000000

   Note

   You can only disable the subordinate ID feature if no subordinate IDs have been allocated yet.