[SSSD] minimal value expected for ldap_idmap_range_size

Stephen Gallagher sgallagh at redhat.com
Fri Mar 14 15:21:42 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/14/2014 09:52 AM, Jakub Hrozek wrote:
> On Thu, Mar 13, 2014 at 06:43:09PM +0100, Pavel Reichl wrote:
>> Hello,
>> 
>> please see attached patch.
>> 
>> Pavel Reichl
> 
>> From da1e349a53e6f5028586a1500b314399d4d01c4e Mon Sep 17 00:00:00
>> 2001 From: Pavel Reichl <preichl at redhat.com> Date: Thu, 13 Mar
>> 2014 17:37:17 +0000 Subject: [PATCH] MAN: minimal value expected
>> for ldap_idmap_range_size
>> 
>> Resolves: https://fedorahosted.org/sssd/ticket/1451 --- 
>> src/man/include/ldap_id_mapping.xml | 8 ++++++++ 1 file changed,
>> 8 insertions(+)
>> 
>> diff --git a/src/man/include/ldap_id_mapping.xml
>> b/src/man/include/ldap_id_mapping.xml index
>> 64d2c159d3b7ea0d946dbbdd6d8ab0e38bcd92d5..aaeb99f873570febb5b0e1c15bbcf8c085491fe3
>> 100644 --- a/src/man/include/ldap_id_mapping.xml +++
>> b/src/man/include/ldap_id_mapping.xml @@ -170,6 +170,14 @@
>> ldap_schema = ad as it can. </para> <para> +
>> NOTE: A value of this option should be at least the
> ~~~ Can you check with some native speaker whether there should be
> "The value" instead?
>> +                            user's corresponding RID on the AD
>> Server otherwise
> ~~~~~ I don't hink you need to use a capital S here
>> +                            lookups and enumeration for the user
>> will not work. +                            E.g. for a user with
>> a +
>> objectSid=S-1-5-21-2153326666-2176343378-3404031434-1107, +
>> <quote>ldap_idmap_range_size</quote> should be at least 1107. +
>> </para> +                        <para> Default: 200000 </para> 
>> </listitem> -- 1.8.4.2
>> 
> 


Recommended rephrasing:

NOTE: The value of this option must be at least as large as the
highest user RID planned for use on the Active Directory server. User
lookups and login will fail for any user whose RID is greater than
this value.

For example, if your most recently-added Active Directory user has
objectSid=S-1-5-21-2153326666-2176343378-3404031434-1107,
<quote>ldap_idmap_range_size</quote> must be at least 1107.

It is important to plan ahead for future expansion, as changing this
value will result in changing all of the ID mappings on the system,
leading to users with different local IDs than they previously had.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlMjHoYACgkQeiVVYja6o6OVHQCglLD2p00hjYVJ44w3nOW4R3jS
gW8An0Zj+YYFvLrXFDUfQ/s6OMxNIDYp
=yP44
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list