9.10. 在 CLI 上为 POSIX ID range 启用自动私有组映射

流程

1. 显示所有 ID range，并记录您要修改的 AD ID range。

   [root@server ~]# ipa idrange-find

   ----------------
   2 ranges matched
   ----------------
     Range name: IDM.EXAMPLE.COM_id_range
     First Posix ID of the range: 882200000
     Number of IDs in the range: 200000
     Range type: local domain range
   
     Range name: AD.EXAMPLE.COM_id_range
     First Posix ID of the range: 1337000000
     Number of IDs in the range: 200000
     Domain SID of the trusted domain: S-1-5-21-4123312420-990666102-3578675309
     Range type: Active Directory trust range with POSIX attributes
   ----------------------------
   Number of entries returned 2
   ----------------------------

2. 使用 ipa idrange-mod 命令调整 AD ID range 的自动私有组行为。

   [root@server ~]# ipa idrange-mod --auto-private-groups=hybrid AD.EXAMPLE.COM_id_range

3. 重置 SSSD 缓存以启用新的设置。

   [root@server ~]# sss_cache -E