Hello again,
I have resolved the problem myself.
Following
https://access.redhat.com/solutions/659243 the sssd cache must be erased using:
service sssd stop; rm -f /var/lib/sss/db/*; service sssd start
seems that the way I used "sss_cache -E" doesn't work on this.
Thanks & Regards.
From: SOLER SANGUESA Miguel
Sent: Monday, February 04, 2019 12:46
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Subject: Error: "has a RID that is larger than the ldap_idmap_range_size"
hello,
I have a IDM cluster (Master + Replica) verison 4.5.4 on REHL 7.4. I have created a trust
with an AD 2016 domain
AD.COMPANY.ORG. Some users are working properly, but I created a
new AD user and it is not working. Checking on the sssd logs I found:
[sdap_idmap_sid_to_unix] (0x0040): Object SID
[S-1-5-21-XXXXXXXXX-2674911608-YYYYYYYY-208726] has a RID that is larger than the
ldap_idmap_range_size. See the "ID MAPPING" section of sssd-ad(5) for an
explanation of how to resolve this issue.
[sdap_idmap_sid_to_unix] (0x0080): Could not convert objectSID
[S-1-5-21-XXXXXXXXX-2674911608-YYYYYYYY-208726] to a UNIX ID
[sssd[be[ipa.AD.COMPANY.ORG]]] [sdap_save_user] (0x0020): Failed to save user
[user(a)AD.COMPANY.ORG]
[sssd[be[ipa.AD.COMPANY.ORG]]] [sdap_save_users] (0x0040): Failed to store user 0.
Ignoring.
I've googled it and I found that the range for default has 200000 size, and as the
last number of the SID (in this case 208726) is the used for the ID, it is bigger than the
range so it is normal the error.
The problem is that I have modified the range size:
# ipa idrange-mod --range-size=600000
Range name: AD.COMPANY.ORG_id_range
-------------------------------------------
Modified ID range "AD.COMPANY.ORG_id_range"
-------------------------------------------
Range name: AD.COMPANY.ORG_id_range
First Posix ID of the range: 1467600000
Number of IDs in the range: 600000
First RID of the corresponding RID range: 0
Domain SID of the trusted domain: S-1-5-21-185866794-2674911608-285463921
Range type: Active Directory domain range
I have restarted IPA service, reset sssd cache and I get the same error.
Any idea why it is still failling?
Thanks & Regards.