On ke, 08 elo 2018, Роман Гинович via FreeIPA-users wrote:
Yeah, i'm found it!
nsslapd-errorlog-level: 81920
[08/Aug/2018:14:48:36.815877034 +0300] - DEBUG - ipa-sidgen-postop - Found domain SID
[S-1-5-21-3815719817-1094829178-2612344331].
[08/Aug/2018:14:48:37.775597841 +0300] - DEBUG - ipa-sidgen-postop - Trying to add SID for
[cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config].
[08/Aug/2018:14:48:37.819957874 +0300] - DEBUG - ipa-sidgen-postop -
[cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config] does not have Posix IDs, nothing to do.
[08/Aug/2018:14:48:40.810439175 +0300] - ERR - sidgen_task_thread - [file
ipa_sidgen_task.c, line 194]: Sidgen task starts ...
[08/Aug/2018:14:48:40.864083206 +0300] - DEBUG - ipa-sidgen-postop - Base DN: [dc=domain],
Filter:
[(&(objectclass=ipaobject)(!(objectclass=mepmanagedentry))(|(objectclass=posixaccount)(objectclass=posixgroup)(objectclass=ipaidobject))(!(ipantsecurityidentifier=*)))].
[08/Aug/2018:14:48:41.935631916 +0300] - DEBUG - ipa-sidgen-postop - Trying to add SID for
[uid=bad_user_here,cn=staged users,cn=accounts,cn=provisioning,dc=domain].
[08/Aug/2018:14:48:41.976041848 +0300] - ERR - find_sid_for_ldap_entry - [file
ipa_sidgen_common.c, line 483]: ID value too large.
[08/Aug/2018:14:48:42.226947787 +0300] - ERR - do_work - [file ipa_sidgen_task.c, line
154]: Cannot add SID to existing entry.
[08/Aug/2018:14:48:42.644938556 +0300] - DEBUG - ipa-sidgen-postop - do_work finished with
[19].
[08/Aug/2018:14:48:42.686593559 +0300] - ERR - sidgen_task_thread - [file
ipa_sidgen_task.c, line 199]: Sidgen task finished [19].
ldapsearch -D "cn=Directory Manager" -W -b cn=provisioning,dc=aim
'uid=bad_user_here' | grep -E "uidN|gidN"
uidNumber: -1
gidNumber: -1
After remove his, all done ok.
So, this is a user from the staged area, right?. It
looks like we need
to fix sidgen plugin to ignore users in the staged area. Additionally,
we need to run sid generation when users moved from the staging to
production.
Could you please open an issue at pagure?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland