freeipa

#8807 [RFE] IPA to allow setting a new range type.
Closed: fixed by rcritten. Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla: Bug 1688267

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

While using POSIX id mapping with IPA/AD trust auto_private_groups  not working
as expected
===
# ipa trust-add --type=ad lab.domain.com --admin administrator
--password  --range-type=ipa-ad-trust-posix
Active Directory domain administrator's password:
# id kushal@lab.domain.com
uid=10000(kushal@lab.domain.com) gid=10000 groups=10000,10020(domain
users@lab.domain.com)
===
If I do not use POSIX attribute.
# ipa trust-add --type=ad lab.domain.com --admin administrator
--password  --range-type=ipa-ad-trust
# id kushal@lab.domain.com
uid=672401109(kushal@lab.domain.com)
gid=672401109(kushal@lab.domain.com) groups=672401109(kushal@lab.
domain.com),815100004(ad_admins),672400513(domain users@lab.domain.com)
I have opened this bugzilla based on the suggestion from Jakub
https://bugzilla.redhat.com/show_bug.cgi?id=1649464#c3
Reference BZ:- https://bugzilla.redhat.com/show_bug.cgi?id=1649464

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1688267

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5712

master:

  • a0509eb9d06ab2d3a608af0b67d7d1616ffdecc2 Design doc for idrange option "auto-private-groups"
  • 3844f5b3c83b460dd4684dd874ae38743bb7f565 LDAP schema: new attribute ipaautoprivategroups
  • ba7ab24b2962a9526d66ae4e0a5d7053b2577c86 Trust: add auto private groups option
  • f45a79a78331aaa125d6eb8317d35452c9b95d80 xmlrpc tests: add test for idrange auto-private-groups option

ipa-4-9:

  • 9d3414287068189be896c280f9ea1a6c8bc9d32d Design doc for idrange option "auto-private-groups"
  • 42b8fa60cfbf1551e916816b6d738b44fdff509a LDAP schema: new attribute ipaautoprivategroups
  • cada918c7849dfff61eeef0c6ef1de420288bff0 Trust: add auto private groups option
  • 7ddc191491f9d06ebe28688fe9fb2d1dd80b711e xmlrpc tests: add test for idrange auto-private-groups option

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to A new option was added to define how private groups represented in ID ranges of trusted Active Directory domains. More details can be found in the design document: https://freeipa.readthedocs.io/en/latest/designs/adtrust/auto-private-groups.html
- Custom field design adjusted to https://freeipa.readthedocs.io/en/latest/designs/adtrust/auto-private-groups.html

master:

  • 663cd9af681370afd1d745ff2bdb3f85aa1094cd ipatests: Tests for Autoprivate group.
  • 9d1f227975c895b7f6005ebfac9f4565b09d280e mark xfail for test_idoverride_with_auto_private_group[hybrid]
  • 3403af580d80e349170a0cf03ac99753d1b5d93a Mark xfail test_gidnumber_not_corresponding_existing_group[true,hybrid]

ipa-4-9:

  • 6b70e3c49acc55b5553101cf850fc40978861979 ipatests: Tests for Autoprivate group.
  • 84381001d2e114b1f29fe89e16155c040b56b80f mark xfail for test_idoverride_with_auto_private_group[hybrid]
  • 7ad500e5d3f7d9af81e8a3137158672c6fafb0b4 Mark xfail test_gidnumber_not_corresponding_existing_group[true,hybrid]
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/5712
A new option was added to define how private groups represented in ID ranges of trusted Active Directory domains. More details can be found in the design document: https://freeipa.readthedocs.io/en/latest/designs/adtrust/auto-private-groups.html
https://freeipa.readthedocs.io/en/latest/designs/adtrust/auto-private-groups.html
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.