37.3. Overriding Default Trust View attributes for an AD user on an IdM client with an ID view

Procedure

1. On the IdM server, create an ID view. For example, to create an ID view named example_for_client1:

   $ ipa idview-add example_for_client1
   ---------------------------
   Added ID View "example_for_client1"
   ---------------------------
     ID View Name: example_for_client1

2. On the IdM server, sdd a user override to the example_for_client1 ID view. To override the user’s GID:

   • Enter the ipa idoverrideuser-add command
   • Add the name of the ID view
   • Add the user name, also called the anchor
   • Add the --gidnumber= option:

   $ ipa idoverrideuser-add example_for_client1 ad_user@ad.example.com --gidnumber=732001337
   -----------------------------
   Added User ID override "ad_user@ad.example.com"
   -----------------------------
     Anchor to override: ad_user@ad.example.com
     GID: 732001337

3. On the IdM server, apply example_for_client1 to the client1.idm.example.com IdM client:

   $ ipa idview-apply example_for_client1 --hosts=client1.idm.example.com
   -----------------------------
   Applied ID View "example_for_client1"
   -----------------------------
   hosts: client1.idm.example.com
   ---------------------------------------------
   Number of hosts the ID View was applied to: 1
   ---------------------------------------------

   注意

   The ipa idview-apply command also accepts the --hostgroups option. The option applies the ID view to hosts that belong to the specified host group, but does not associate the ID view with the host group itself. Instead, the --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them.

   This means that if a host is added to the host group in the future, the ID view does not apply to the new host.

4. On the IdM client, clear the entry for the ad_user@ad.example.com user from the SSSD cache on the client1.idm.example.com IdM client. This removes stale data and allows the new override value to apply.

   # sssctl cache-expire -u ad_user@ad.example.com

Verification

1. SSH to the client system as ad_user@ad.example.com:

   # ssh ad_user@ad.example.com@client1.idm.example.com

2. On the client system, retrieve information for the ad_user@ad.example.com user to verify the GID reflects the updated value.

   [ad_user@ad.example.com@client1 ~]$ id ad_user@ad.example.com
   uid=702801456(ad_user@ad.example.com) gid=732001337(admins2)
   groups=732001337(admins2),702800513(domain users@ad.example.com)