Chapter 39. Managing subID ranges manually

Procedure

1. Optional: Check for existing subID ranges:

   # ipa subid-find

   Copy to Clipboard Toggle word wrap

2. If a subID range does not exist, select one of the following options:

   • Generate and assign a subID range to an IdM user:

     # ipa subid-generate --owner=idmuser
     
     Added subordinate id "359dfcef-6b76-4911-bd37-bb5b66b8c418"
     
       Unique ID: 359dfcef-6b76-4911-bd37-bb5b66b8c418
       Description: auto-assigned subid
       Owner: idmuser
       SubUID range start: 2147483648
       SubUID range size: 65536
       SubGID range start: 2147483648
       SubGID range size: 65536

     Copy to Clipboard Toggle word wrap

   • Generate and assign subID ranges to all IdM users:

     # /usr/libexec/ipa/ipa-subids --all-users
     
     Found 2 user(s) without subordinate ids
       Processing user 'user4' (1/2)
       Processing user 'user5' (2/2)
     Updated 2 user(s)
     The ipa-subids command was successful

     Copy to Clipboard Toggle word wrap

3. Optional: Assign subID ranges to new IdM users by default:

   # ipa config-mod --user-default-subid=True

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM WebUI interface expand the Subordinate IDs tab and choose the Subordinate IDs option.
2. When the Subordinate IDs interface appears, click the Add button in the upper-right corner of the interface. The Add subid window appears.
3. In the Add subid window choose an owner, that is the user to whom you want to assign a subID range.
4. Click the Add button.

Procedure

1. Open the /etc/nsswitch.conf file and configure the shadow-utils utility to use IdM subID ranges by setting the subid variable to the sss value:

   [...]
   subid: sss

   Copy to Clipboard Toggle word wrap
   Note

   You can provide only one value for the subid field. Setting the subid field to the file value or no value instead of sss configures the shadow-utils utility to use the subID ranges from the /etc/subuid and /etc/subgid files.

2. List the subID range for an IdM user:

   $ getsubids idmuser
   0: idmuser 2147483648 65536

   Copy to Clipboard Toggle word wrap

   The first value, 2147483648, indicates the subID range start. The second value, 65536, indicates the size of the range.