4:29 a.m.
Am Fri, May 07, 2021 at 04:11:33PM -0000 schrieb iulian roman via FreeIPA-users:
Yes, it is correct and this is exactly what I observed in the tests
(if ipa-ad-trust-posix is not mentioned, the uidNumber and gidNumber
are ignored) and the one within the range is generated.
The situation I have in AD is a "mix" of users without those
attributes and with. If I configure the trust as non-posix, all users
are detected but the uid and gid are ignored for those who have one in
AD, therefore they would not be able to access their home folders
(which has permissions based on AD uid and gid).
I do not know if that is possible (to have IPA using uid and gid
number when they are present in AD and generate a new one when not
present ) or is something which is considered a feature request, but I
thought it is worth asking .
Hi,
it is not possible to have both automatically at the same time. You can
either use the UIDs and GIDs managed in AD or let IPA autogenerated them.
The main reason for this are the different administrative domains. If
the UIDs and GIDs are managed in AD IPA expects that AD administrators
will take care that the IDs make sense and that there are not
collisions. If the IDs are autogenerated on the IPA side IPA takes care
of this.
If you mix both you might run into cases where a user or group is added
to AD and somewhat later a UID or GID is assigned in AD. If the new
object what picked up in between by IPA and got an ID assigned
automatically you now have 2 IDs for the same object.
However, to make migration from legacy domains more easy id-overrides
where added to IPA. With this you can use autogenerated IDs for all users
and groups from AD but add individual UIDs or GIDs to selected users and
groups. With this all the ID management is inside the IPA domain and it
is up to the IPA administrators to make sure the object which needed an
id-override is not used before (or on the systems where is was already
used the filesystem permissions are updated accordingly).
HTH
bye,
Sumit
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure