Request for enhancement

As a system administrator, I want to be able to lookup FreeIPA AD Trusted accounts whose UID's are < 1000 so that legacy integration requiring LDAP lookups can continue to work.

Issue

We have enabled the compat module so that we can query the IdM LDAP service for POSIX information of external (AD Trusted) accounts.

While this works for most accounts (including native IdM ones with UID's < 1000). the (external) AD trusted ones who have been mapped to UID's < 1000 do not appear in the compat tree and hence cannot be searched for.

For instance, the following returns nothing if the low-uid-user account has a UID of 512.

ldapsearch -x -LLL -H "ldaps://server.idm.example.com" -b 'cn=compat,dc=idm,dc=example,dc=com' '(&(objectClass=posixAccount)(uid=low-uid-user@ad.example.com))'

We understand that UID's < 1000 should be avoided under RHEL9... however due to external limitations we are not currently in a position to migrate these UID's to a higher range at this time.

I've tried setting the following compat configuration (as well as adjusting MIN_UID/SYS_MAX_UID, etc within logins.defs), but it did not help:

schema-compat-nsswitch-min-id: 500

Steps to Reproduce

1. Install FreeIPA with compat support (idm.example.com)
2. Establish a trust with AD (ad.example.com)
3. Create ID View entries to map AD UID's back to their previous values (some of which are in the 500-999 range)
4. Attempt to query an AD Trusted user with a UID within the 500-999 range:

Actual behavior

ldapsearch -x -LLL -H "ldaps://server.idm.example.com" -b 'cn=compat,dc=idm,dc=example,dc=com' '(&(objectClass=posixAccount)(uid=low-uid-user@ad.example.com))'

NOTHING RETURNED - IE NO RECORD FOUND FOR USERS WITH UID's between 500-999

Expected behavior

ldapsearch -x -LLL -H "ldaps://server.idm.example.com" -b 'cn=compat,dc=idm,dc=example,dc=com' '(&(objectClass=posixAccount)(uid=low-uid-user@ad.example.com))'

RECORDS RETURNED FOR USERS WITH UID's between 500-999

Version/Release/Distribution

ipa-server-4.12.2-14.el9_6.5.x86_64
ipa-client-4.12.2-14.el9_6.5.x86_64
389-ds-base-2.6.1-12.el9_6.x86_64
package pki-ca is not installed
krb5-server-1.21.1-8.el9_6.x86_64

Additional info:

Just to summarise, the LDAP 'compat' tree contains all local IdM accounts no matter what their UID, however it only contains the "external" (AD Trusted) accounts whose UID's are mapped to >= 1000.

And the background to this request:

We have an existing FreeIPA solution running on RHEL7 is utilising WinSync and has been working very well for a long period of time. Unfortunately, it seems that WinSync is not going to be supported so when refreshing the Operating System and FreeIPA software we've been forced to go down the AD-Trust route. This has led to a large number of issues for our environment:

• Drastic slowdowns if we want to utilise the AD Groups for anything.
• More complexity when assigning users to IdM POSIX groups (have to create external group, have it become a member, etc).
• Issues for all systems that were integrating via LDAP against the old environment (these need access to UID, GID, and Groups).
• Creation of ID View overrides for all existing users to maintain their previous UID/GID as we have several Petabytes of NFS storage and locating and changing ownership of users files is simply not feasible.

We are trying to (at least) get the compat "users" tree working so that systems can query the assigned UID/GID of the users.