ID ranges
How the local range and each trusted domain's range decide uid and gid, what the range types mean, how an AD user's uid is derived from its SID, and why a range cannot be edited freely later.
This page covers the ID ranges page under IPA Server. ID ranges define the intervals uid and gid are allocated from. Local users take sequential numbers from the local range. AD users are not in the directory; their uid is computed from the SID through the trust range, so every Linux host sees the same number.
Shipped ranges
| Range | Type | Notes |
|---|---|---|
<REALM>_id_range | Local domain range | A random 200000-ID block chosen at install (example 60000 to 261999); all IPA users and groups come from it. The random start avoids collisions when IPA domains are merged later |
<REALM>_subid_range | Subordinate ID range | For Subordinate IDs, from 2147483648 |
<AD domain>_id_range | AD trust range | Created with the trust, 200000 IDs, one per trusted AD domain |
IPA implements the subordinate range internally as an AD-trust type range (ipa-ad-trust, with an internal SID); ipa idrange-show --raw returns the same value. The list showing its type as Active Directory domain range is expected.
Fields
| Field | Meaning |
|---|---|
| First Posix ID of the range, Number of IDs in the range | The interval. Ranges must not overlap |
| Primary RID base, Secondary RID base | Local range only, for Samba: an IPA user's SID is the domain SID plus the RID, and the RID is the base plus (uid minus start). The secondary base is for groups |
| Range type | See below |
| Domain SID | The AD domain a trust range is bound to |
| Range type | Meaning |
|---|---|
ipa-local | Local |
ipa-ad-trust | AD users' uids are computed as start plus (RID mod range size). AD needs no POSIX attributes |
ipa-ad-trust-posix | Reads uidNumber and gidNumber from the AD user object (AD carries and maintains RFC 2307 attributes). The range must cover the numbers actually used in AD |
The ipa-ad-trust algorithm guarantees that the same SID yields the same uid on every client. Once RIDs exceed the range size (more than 200000 AD users), a second range for the same domain is needed.
Boundaries
| Topic | Notes |
|---|---|
| Editing a used range | A range that has handed out IDs cannot be shrunk or have its start moved. Growth means adding a range, not editing one |
| Changing the local range | Existing users are not renumbered; only new objects are affected |
| Deleting a trust range | AD users' uids vanish on Linux and file ownership turns numeric. Recreating the range with the same parameters restores the same uids |
| Client cache | sssd caches do not follow range changes. Run sss_cache -E afterwards |
Trusts
Requires the ad-trust module. The Trusts page shows and fine-tunes an established AD trust, including trust type, trusted domains, UPN suffixes and SID blocklists, plus the NetBIOS name and fallback primary group in the global config. Creating the trust is CLI work.
Topology
The replication topology between masters, with nodes, segments, the domain and ca suffixes, what a healthy topology looks like, and where replication status is read.