It worked! Thanks so much for your help.
On 2/8/17, 12:20 PM, "Alexander Bokovoy" <aboko...@redhat.com> wrote: On ke, 08 helmi 2017, Armaan Esfahani wrote: >I have found the following. > >[08/Feb/2017:11:14:38 -0500] sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... >[08/Feb/2017:11:14:38 -0500] find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID  into an unused SID. >[08/Feb/2017:11:14:38 -0500] do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. >[08/Feb/2017:11:14:38 -0500] sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished . > >I assume this is the second possibility you brought up, the ID ranges I >have setup do not allow mapping of UID/GID to SID Yes. Check existing ID ranges to see if you have one that covers POSIX ID 755400050. If there is none, you need to create another ID range that covers those users. This typically comes from cases where POSIX IDs were assigned manually or from already existing source via migration. At this point FreeIPA would not have an ID range that covers these pre-allocated IDs. So you need to define several variables here: - base ID of the range - range size -- enough to cover those existing users and groups that are outside of IPA ID range - RID bases -- since we are building SIDs for the same domain, the RID base and secondary RID base should not be overlapping with existing IPA ID range For example, if you have 100 users starting around 755400000 and your default IPA ID range has 200000 entries (default range size), then mapping RID base above that one would be enough. ipa idrange-add MY.DOM.AIN-extra_id_range --base-id=755400000 --range-size=100 \ --rid-base=500000 --secondary-rid-base=500100 \ --type=ipa-local Adding this range would be enough -- there will not be any allocation of POSIX IDs in the range but sidgen plugin will be able to use the range to drive SID allocation. > >On 2/8/17, 11:10 AM, "Alexander Bokovoy" <aboko...@redhat.com> wrote: > > On ke, 08 helmi 2017, Armaan Esfahani wrote: > >I’ve been having issues with some of my IPA seemingly not getting SID’s > >after the install, even after running with the –add-sids modifier. I > >was wondering where the SID values are located so that I can take a > >look at what’s happening/ > In the user object itself, ipaNTSecurityIdentifier attribute. > > If you have SIDs not generated, there are two potential issues that > cause it: > - sidgen plugin configuration looking at wrong basedn > - ID ranges you have do not allow to map UID/GID to SID > > If you ran ipa-adtrust-install --add-sids and it generated nothing, look > at /var/log/dirsrv/slapd-INSTANCE/errors log file. There should be at > least two lines: > > [01/Feb/2017:14:28:24.189906631 +0100] sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... > [01/Feb/2017:14:28:24.192039515 +0100] sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished . > > If there are any errors causing issues with SID generation, they will be > in between these two lines. > > > -- > / Alexander Bokovoy > > > > >-- >Manage your subscription for the Freeipa-users mailing list: >https://www.redhat.com/mailman/listinfo/freeipa-users >Go to http://freeipa.org for more info on the project -- / Alexander Bokovoy -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project