I’ve been getting messages like these when I try the id command for a test AD 
domain user:

(Tue Mar 17 17:10:34 2015) [sssd[be[unix.test.osuwmc]]] [sdap_get_primary_name] 
(0x0400): Processing object farus@test.osuwmc
(Tue Mar 17 17:10:34 2015) [sssd[be[unix.test.osuwmc]]] [sdap_save_user] 
(0x0400): Processing user farus@test.osuwmc
(Tue Mar 17 17:10:34 2015) [sssd[be[unix.test.osuwmc]]] [sdap_save_user] 
(0x1000): Mapping user [farus@test.osuwmc] objectSID 
[S-1-5-21-226267946-722566613-1883572810-398410] to unix ID
(Tue Mar 17 17:10:34 2015) [sssd[be[unix.test.osuwmc]]] 
[sdap_idmap_sid_to_unix] (0x0080): Could not convert objectSID 
[S-1-5-21-226267946-722566613-1883572810-398410] to a UNIX ID
(Tue Mar 17 17:10:34 2015) [sssd[be[unix.test.osuwmc]]] [sdap_save_user] 
(0x0020): Failed to save user [adm-faru03@test.osuwmc]

Various sources all inicate that its a range issue with ldap_idmap_range_size. 
I’ve tried several large values of just ldap_idmap_range_size as well as adding 
ldap_idmap_range_min and ldap_idmap_range_range. All I can figure is that 
perhaps sssd is ignoring the values? Between changing values I did stop sssd, 
delete the cache and restart it. This is RHEL7 fully up to date. My SSSD shows 

Here is my full sssd.conf.

debug_level = 9
subdomains_provider = ipa
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = unix.test.osuwmc
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = mid-ipa-vp01.unix.test.osuwmc
chpass_provider = ipa
ipa_server = mid-ipa-vp01.unix.test.osuwmc
ipa_server_mode = True
ldap_tls_cacert = /etc/ipa/ca.crt
#ldap_idmap_range_min = 2000
#ldap_idmap_range_size = 900000
#ldap_idmap_range_range = 3602000
ldap_id_mapping = True

services = nss, sudo, pam, ssh, pac
config_file_version = 2

domains = unix.test.osuwmc
homedir_substring = /home







Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to