Yes, it is correct and this is exactly what I observed in the tests (if ipa-ad-trust-posix is not mentioned, the uidNumber and gidNumber are ignored) and the one within the range is generated. The situation I have in AD is a "mix" of users without those attributes and with. If I configure the trust as non-posix, all users are detected but the uid and gid are ignored for those who have one in AD, therefore they would not be able to access their home folders (which has permissions based on AD uid and gid). I do not know if that is possible (to have IPA using uid and gid number when they are present in AD and generate a new one when not present ) or is something which is considered a feature request, but I thought it is worth asking .