ID ranges
How the local range and each trusted domain's range decide uid / gid, what the range types mean, how an AD user's uid is derived from its SID, and why a range cannot simply be edited later.
ID ranges define the intervals uid / gid are allocated from. Local users take sequential numbers from the local range; AD users are not in the directory, their uid is computed from the SID through the trust range, so every Linux host sees the same number.
Shipped ranges
| Range | Type | Notes |
|---|---|---|
<REALM>_id_range | local domain range | a random 200000-ID block chosen at install (example 60000–261999); all IPA users / groups come from it. The random start avoids collisions when IPA domains are merged later |
<REALM>_subid_range | subordinate ID range | for Subordinate IDs, from 2147483648 |
<AD domain>_id_range | AD trust range | created with the trust, 200000 IDs, one per trusted AD domain |
IPA implements the subordinate range internally as an AD-trust type range (ipa-ad-trust, with an internal SID); ipa idrange-show --raw returns the same value, so the list showing its type as "Active Directory domain range" is expected.
Fields
| Field | Meaning |
|---|---|
| First Posix ID of the range / Number of IDs in the range | the interval; ranges must not overlap |
| Primary RID base / Secondary RID base | local range only, for Samba: an IPA user's SID = domain SID + RID, RID = base + (uid − start). Secondary base is for groups |
| Range type | see below |
| Domain SID | the AD domain a trust range is bound to |
| Range type | Meaning |
|---|---|
ipa-local | local |
ipa-ad-trust | AD users' uids are computed: start + (RID mod range size). AD needs no POSIX attributes |
ipa-ad-trust-posix | read uidNumber / gidNumber from the AD user object (AD carries and maintains RFC 2307 attributes). The range must cover the numbers actually used in AD |
The ipa-ad-trust algorithm guarantees the same SID yields the same uid on every client; once RIDs exceed the range size (more than 200000 AD users) a second range for the same domain is needed.
Boundaries
- A range that has handed out IDs cannot be shrunk or have its start moved; growth means adding a range, not editing one.
- Changing the local range does not renumber existing users; only new ones are affected.
- Deleting a trust range makes AD users' uids vanish on Linux and file ownership turns numeric; recreating the range with the same parameters restores the same uids.
- Client sssd caches do not follow range changes; run
sss_cache -Eafterwards.
Trusts
Requires the ad-trust module. The Trusts page shows and fine-tunes an established AD trust: trust type, trusted domains, UPN suffixes, SID blocklists; NetBIOS name and fallback primary group in the global config. Creating the trust is CLI work.
Topology
The replication topology between masters: nodes, segments, the domain and ca suffixes, what a healthy topology looks like, and that replication status lives on the CLI.