Aha. Some research showed that this can happen if the UID is not in any idrange, which is the case here because I modified the dnaNextValues manually for LXC/proxmox reasons, but that didn't align with the ID range entry in free ipa which was not updated.
Updated that with ldapmodify and something like this, and now all is well. dn: cn=DOMAIN.TLD_id_range,cn=ranges,cn=etc,dc=domain,dc=tld changetype: modify replace: ipaBaseID ipaBaseID: 70000 - replace: ipaIDRangeSize ipaIDRangeSize: 10000 -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
