38.4. Adding a new IdM ID range

Procedure

1. To create a new IdM ID range, use the ipa idrange-add command. You must specify the new range name, the first ID number of the range, the range size, and the first RID number of the primary and secondary RID range:

   # ipa idrange-add IDM.EXAMPLE.COM_new_range --base-id 5000 --range-size 1000 --rid-base 300000 --secondary-rid-base 1300000
   
   ipa: WARNING: Service dirsrv@IDM-EXAMPLE-COM.service requires restart on IPA server <all IPA servers> to apply configuration changes.
   ------------------------------------------
   Added ID range "IDM.EXAMPLE.COM_new_range"
   ------------------------------------------
     Range name: IDM.EXAMPLE.COM_new_range
     First Posix ID of the range: 5000
     Number of IDs in the range: 1000
     First RID of the corresponding RID range: 300000
     First RID of the secondary RID range: 1300000
     Range type: local domain range

2. Restart the Directory Server service on all IdM servers in the deployment:

   # systemctl restart dirsrv@IDM-EXAMPLE-COM.service

   This ensures that when you create users with UIDs from the new range, they have security identifiers (SIDs) assigned.

3. Optional: Update the ID range immediately:

   1. Clear the System Security Services Daemon (SSSD) cache:

      # sss_cache -E

   2. Restart the SSSD daemon:

      # systemctl restart sssd

      注記

      If you do not clear the SSSD cache and restart the service, SSSD only detects the new ID range when it updates the domain list and other configuration data stored on the IdM server.