13.2. Enabling Security Identifiers (SIDs) in IdM

Prerequisites

• You installed IdM before RHEL 8.5.
• You have not run the ipa-sidgen task, which is part of configuring a trust with an Active Directory domain.
• You can authenticate as the IdM admin account.

Procedure

• Enable SID usage and trigger the SIDgen task to generate SIDs for existing users and groups. This task might be resource-intensive:

  [root@server ~]# ipa config-mod --enable-sid --add-sids

Verification

• Verify that the IdM admin user account entry has an ipantsecurityidentifier attribute with a SID that ends with -500, the SID reserved for the domain administrator:

  [root@server ~]# ipa user-show admin --all | grep ipantsecurityidentifier
    ipantsecurityidentifier: S-1-5-21-2633809701-976279387-419745629-500