38.12. Enabling UIDs up to Linux maximum limit for legacy systems compatibility

Procedure

1. Disable the subordinate ID feature:

   $ ipa config-mod --addattr ipaconfigstring=SubID:Disable

2. Remove any existing subordinate ID ranges:

   $ ipa idrange-del <id_range>

3. On the IdM server, ensure the internal DNA plugin configuration is correctly removed:

   # ipa-server-upgrade

4. Add a new local ID range that covers the 2^31 to 2^32-1 space. Ensure that you define RID bases for this new range so that IdM can generate SIDs properly for users and groups. For example:

   $ ipa idrange-add IDM.EXAMPLE.COM_new_range --base-id 2200000000 --range-size 200000 --rid-base 1000 --secondary-rid-base 2300000000

   참고

   You can only disable the subordinate ID feature if no subordinate IDs have been allocated yet.