9.10. Enabling automatic private group mapping for a POSIX ID range on the CLI

Procedure

1. Display all ID ranges and make note of the AD ID range you want to modify.

   [root@server ~]# ipa idrange-find
   ----------------
   2 ranges matched
   ----------------
     Range name: IDM.EXAMPLE.COM_id_range
     First Posix ID of the range: 882200000
     Number of IDs in the range: 200000
     Range type: local domain range
   
     Range name: AD.EXAMPLE.COM_id_range
     First Posix ID of the range: 1337000000
     Number of IDs in the range: 200000
     Domain SID of the trusted domain: S-1-5-21-4123312420-990666102-3578675309
     Range type: Active Directory trust range with POSIX attributes
   ----------------------------
   Number of entries returned 2
   ----------------------------

2. Adjust the automatic private group behavior for the AD ID range with the ipa idrange-mod command.

   [root@server ~]# ipa idrange-mod --auto-private-groups=hybrid AD.EXAMPLE.COM_id_range

3. Reset the SSSD cache to enable the new setting.

   [root@server ~]# sss_cache -E