22.7. Adding users without a user private group

• Add a new user without a UPG, without disabling private groups globally. See Adding a user without a user private group when private groups are globally enabled.
• Disable UPGs globally for all users, then add a new user. See Disabling user private groups globally for all users and Adding a user when user private groups are globally disabled.

Procedure

• To prevent IdM from creating a UPG, add the --noprivate option to the ipa user-add command.

  Note that for the command to succeed, you must specify a custom GID. For example, to add a new user with GID 10000:

  $ ipa user-add jsmith --first=John --last=Smith --noprivate --gid 10000

Verification

• To check if UPGs are globally disabled, use the disable command again:

  $ ipa-managed-entries -e "UPG Definition" disable
  Plugin already disabled

Prerequisites

• UPGs must be disabled globally for all users. For more information, see Disabling user private groups globally for all users

Procedure

• To make sure adding a new user succeeds when creating UPGs is disabled, choose one of the following:

  • Specify a custom GID when adding a new user. The GID does not have to correspond to an already existing user group.

    For example, when adding a user from the command line, add the --gid option to the ipa user-add command.

  • Use an automember rule to add the user to an existing group with a GID. See Automating group membership using IdM CLI.