38.7. Using Ansible to add a new local IdM ID range

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create the idrange-present.yml playbook with the following content:

   ---
   - name: Playbook to manage idrange
     hosts: ipaserver
     become: no
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure local idrange is present
       ipaidrange:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: new_id_range
         base_id: 12000000
         range_size: 200000
         rid_base: 1000000
         secondary_rid_base: 200000000

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory idrange-present.yml

5. SSH to ipaserver and restart the Directory Server:

   # systemctl restart dirsrv@IDM.EXAMPLE.COM.service

   This ensures that when you create users with UIDs from the new range, they have security identifiers (SIDs) assigned.

6. Optional: Update the ID range immediately:

   1. On ipaserver, clear the System Security Services Daemon (SSSD) cache:

      # sss_cache -E

   2. On ipaserver, restart the SSSD daemon:

      # systemctl restart sssd

   注意

   If you do not clear the SSSD cache and restart the service, SSSD only detects the new ID range when it updates the domain list and other configuration data stored on the IdM server.