fedora-infrastructure

#12641 ipa users and groups cannot be added.
Closed: Fixed by abompard. Opened by kevin.

Closed: Fixed
Reopen Issue

Attempting to add a new group in ipa:

IPA Error 4203: DatabaseError
Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.

When you attempt to register as a new user, you get to the end of the flow (step 3/3) where you enter your password. This fails and the noggin logs have: 

ERROR in registration: An unhandled error BadRequest happened while activating stage user REDACTED: Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.

So, it looks like we have some id range issues.

CC: @zlopez

I can add a 4th ID range, following this guide: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_identity_management/adjusting-id-ranges-manually_configuring-and-managing-idm#adding-a-new-idm-id-range_adjusting-id-ranges-manually

Metadata Update from @abompard:
- Issue assigned to abompard

 
# ipa idrange-add FEDORAPROJECT.ORG_fourth_id_range --base-id 1501200001 --range-size 600000 --rid-base 3200000 --secondary-rid-base 3800000
ipa: WARNING: Service dirsrv@FEDORAPROJECT-ORG.service requires restart on IPA server <all IPA servers> to apply configuration changes.
--------------------------------------------------
Added ID range "FEDORAPROJECT.ORG_fourth_id_range"
--------------------------------------------------
  Range name: FEDORAPROJECT.ORG_fourth_id_range
  First Posix ID of the range: 1501200001
  Number of IDs in the range: 600000
  First RID of the corresponding RID range: 3200000
  First RID of the secondary RID range: 3800000
  Range type: local domain range

And the docs asks to restart dirsrv, so:

[root@ipa01 ~][PROD-RDU3]# systemctl restart dirsrv@FEDORAPROJECT-ORG.service
[root@ipa02 ~][PROD-RDU3]# systemctl restart dirsrv@FEDORAPROJECT-ORG.service
[root@ipa03 ~][PROD-RDU3]# systemctl restart dirsrv@FEDORAPROJECT-ORG.service

Metadata Update from @abompard:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Proof that our setup is correct:

# ipa-idrange-fix 
------------------------------------------------------------------------------------------------------------------------------------------------------------------
| name                              | type         | size       | first_id   | last_id    | base_rid   | last_base_rid | secondary_base_rid | last_secondary_rid | 
------------------------------------------------------------------------------------------------------------------------------------------------------------------
|                    early_accounts |    ipa-local |     100000 |     100000 |     199999 |    1800000 |       1900000 |            1900000 |            2000000 | 
|        FEDORAPROJECT.ORG_id_range |    ipa-local |     200000 | 1494200000 | 1494399999 |       1000 |        201000 |             201000 |             401000 | 
| FEDORAPROJECT.ORG_second_id_range |    ipa-local |     600000 | 1500000000 | 1500599999 |     500000 |       1100000 |            1101000 |            1701000 | 
|  FEDORAPROJECT.ORG_third_id_range |    ipa-local |     600000 | 1500600001 | 1501200000 |    2000000 |       2600000 |            2600000 |            3200000 | 
| FEDORAPROJECT.ORG_fourth_id_range |    ipa-local |     600000 | 1501200001 | 1501800000 |    3200000 |       3800000 |            3800000 |            4400000 | 
|     FEDORAPROJECT.ORG_subid_range | ipa-ad-trust | 2147352576 | 2147483648 | 4294836223 | 2147283648 |               |                    |                    | 
------------------------------------------------------------------------------------------------------------------------------------------------------------------
All ID ranges have base RIDs set, RID adjustments are not needed.
Users out of range found: 0
Preserved users out of range found: 0
Groups out of range found: 0
No out of range IDs found!
Summary:
No IDs under 1000 found.
No changes proposed for existing ranges.
No new ranges proposed.
No changes proposed, nothing to do.
The ipa-idrange-fix command was successful

I wonder if we could put something in place to monitor the idrange usage?
I've asked on the freeipa-users list: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/5B2RLGODMIB3GN2MYAI6I6XRSLSFOK6M/

I forgot about the idrange again :/ It is not replicated.

Issue status updated to: Open (was: Closed)

Metadata Update from @zlopez:
- Issue tagged with: authentication, dc-move, high-gain, low-trouble, ops

Metadata Update from @zlopez:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @kevin:
- Issue status updated to: Open (was: Closed)

I tried to make a test user and got:

[2025-07-08 21:11:00,819] ERROR in registration: An unhandled error BadRequest happened while activating stage user kevintest6: Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.

@abompard Did you check if the idrange was correctly distributed to all servers, also there is dnarange as well.

OK so there was a problem with the dnarange as well. This is the allocation of the ID range among replica, and is not replicated between servers (each server gets its own, it's local).

I tried to follow these KB entries:
- https://access.redhat.com/solutions/2196791
- https://access.redhat.com/articles/7027037

Previous ticket: https://pagure.io/fedora-infrastructure/issue/11740

At first there was no range assigned:

# ipa-replica-manage dnarange-show
ipa01.rdu3.fedoraproject.org: No range set
ipa02.rdu3.fedoraproject.org: No range set
ipa03.rdu3.fedoraproject.org: No range set

Following @abbra 's advice I assigned the entire ID ranges to the ipa01 but it didn't work because there are gaps in our ID ranges:

ipa-replica-manage dnarange-set ipa01.rdu3.fedoraproject.org 1494200000-1501200000                                                                                                                                                  
New range does not fit within existing IPA ranges. See ipa help idrange command

So I assigned the third id range:

# ipa-replica-manage dnarange-set ipa01.rdu3.fedoraproject.org 1500600003-1501200000                   
# ipa-replica-manage dnarange-show                                                                     
ipa01.rdu3.fedoraproject.org: 1500600003-1501200000
ipa02.rdu3.fedoraproject.org: No range set
ipa03.rdu3.fedoraproject.org: No range set

Creating a user account on ipa01 worked, and it did not reuse an existing uidnumber. The dnarange was updated:

[root@ipa01 ~][PROD-RDU3]# ipa-replica-manage dnarange-show 
ipa01.rdu3.fedoraproject.org: 1500600480-1501200000
ipa02.rdu3.fedoraproject.org: No range set
ipa03.rdu3.fedoraproject.org: No range set

But creating a user on ipa02 didn't work, the user was created but the uidnumber and gidnumbers were set to -1:

# ipa user-add --first Aurelien --last Test --fasstatusnote TEST abompard3
----------------------
Added user "abompard3"
----------------------
  User login: abompard3
[...]
  UID: -1
  GID: -1
[...]

So I manually spread the dnarange among replicas as Kevin did in the previous ticket

[root@ipa01 ~][PROD-RDU3]# ipa-replica-manage dnarange-set ipa01.rdu3.fedoraproject.org 1500600001-1500800000
[root@ipa01 ~][PROD-RDU3]# ipa-replica-manage dnarange-set ipa02.rdu3.fedoraproject.org 1500800001-1501000000
[root@ipa01 ~][PROD-RDU3]# ipa-replica-manage dnarange-set ipa03.rdu3.fedoraproject.org 1501000001-1501200000

This worked, creation of users work now on ipa01 and ipa02. The current DNA ranges are:

# ipa-replica-manage dnarange-show 
ipa01.rdu3.fedoraproject.org: 1500600002-1500800000
ipa02.rdu3.fedoraproject.org: 1500800009-1501000000
ipa03.rdu3.fedoraproject.org: 1501000001-1501200000

User creation in Noggin works again.

Oh and by the way, since that was the actual cause of the problem, I've removed the fourth ID range:

# ipa idrange-del FEDORAPROJECT.ORG_fourth_id_range
ipa: WARNING: Service sssd.service requires restart on IPA server <all IPA servers> to apply configuration changes.
ipa: WARNING: Service dirsrv@FEDORAPROJECT-ORG.service requires restart on IPA server <all IPA servers> to apply configuration changes.
----------------------------------------------------
Deleted ID range "FEDORAPROJECT.ORG_fourth_id_range"
----------------------------------------------------
[root@ipa01 ~][PROD-RDU3]# systemctl restart dirsrv@FEDORAPROJECT-ORG.service
[root@ipa02 ~][PROD-RDU3]# systemctl restart dirsrv@FEDORAPROJECT-ORG.service
[root@ipa03 ~][PROD-RDU3]# systemctl restart dirsrv@FEDORAPROJECT-ORG.service

I deleted all the stage accounts, so people trying to register again are not blocked by existing account.

Fixing staging is blocked by #12648

Metadata Update from @abompard:
- Issue marked as depending on: #12648

Unblocked! :)

I got confirmed by one user that creating new account is now possible :-)

New DNA ranges on staging:

[root@ipa01 ~][STG]# ipa-replica-manage dnarange-show
ipa01.stg.rdu3.fedoraproject.org: 162800000-162900000
ipa02.stg.rdu3.fedoraproject.org: 162900001-162950000
ipa03.stg.rdu3.fedoraproject.org: 162950001-163000000

Metadata Update from @abompard:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata

authentication dc-move high-gain low-trouble ops

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.