On Tue, 16 May 2023, Andreas Binapfl via FreeIPA-users wrote:
Greetings, we also upgraded to RHEL9.2 and got the auth problems.
following the advice here i wanted to use "ipa config-mod --enable-sid
--add-sids" but unfortunately i get an error in /etc/messages
ERR - ipa_range_check_pre_op - [file ipa_range_check.c, line 670]: New primary rid range
overlaps with existing primary rid range.
Using ipa idrange-find
----------------
3 ranges matched
----------------
Range name: DOMAIN.LOCAL_id_range
First Posix ID of the range: 512800000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range type: local domain range
Range name: DOMAIN.LOCAL_new_range
First Posix ID of the range: 1600
Number of IDs in the range: 2000
Range type: local domain range
This one is a bit weird. Can you please show
ipa idrange-show --all --raw DOMAIN.LOCAL_new_range
?
Range name: DOMAIN.LOCAL_subid_range
First Posix ID of the range: 2147483648
Number of IDs in the range: 2147352576
First RID of the corresponding RID range: 2147283648
Domain SID of the trusted domain: S-1-5-21-738065-838566-2958400175
Range type: Active Directory domain range
----------------------------
Number of entries returned 3
On a first glance they seems not to overlap. Can someone help me how i
can troubleshoot that problem further?
The error message is quite clear -- there is some range that overlaps in
its parameters with existing range. It comes from this code in the range
check plugin:
/* For ipa-local or ipa-ad-trust range types primary RID ranges should
* not overlap */
if (strcasecmp(r1->id_range_type, AD_TRUST_RANGE_TYPE) == 0 ||
strcasecmp(r1->id_range_type, LOCAL_RANGE_TYPE) == 0) {
/* Check if primary rid range overlaps with existing primary rid range */
if ((r1->base_rid_set && r2->base_rid_set) &&
intervals_overlap(r1->base_rid, r2->base_rid,
r1->id_range_size, r2->id_range_size))
return RANGE_CHECK_PRIMARY_PRIMARY_RID_OVERLAP;
}
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland