14.5. Manual ID Range Extension and Assigning a New ID Range
- An assigned ID range has been depleted
- A replica has exhausted the ID range that was assigned to it, and requesting additional IDs failed because no more free IDs are available in the ID ranges of other replicas. You want to extend the ID range assigned to the replica. This might involve splitting an existing ID range or extending it past the initial configured ID range for the server. Alternatively, you might want to assign a new ID range.
NoteIf you assign a new ID range, the UIDs of the already existing entries on the server or replica stay the same. This does not pose a problem because even if you change the current ID range, IdM keeps a record of what ranges were assigned in the past.
- A replica stopped functioning
- ID range is not automatically retrieved when a replica dies and needs to be deleted, which means the ID range previously assigned to the replica becomes unavailable. You want to recover the ID range and make it available for other replicas.If you want to recover the ID range belonging to a server that stopped functioning and assign it to another server, first find out what are the ID range values using the
ipa-replica-manage dnarange-showcommand described in Section 14.3, “Displaying Currently Assigned ID Ranges”, and then manually assign that ID range to the server. Also, to avoid duplicate UIDs or GIDs, make sure that no ID value from the recovered range was previously assigned to a user or group; you can do this by examining the UIDs and GIDs of existent users and groups.
ipa-replica-manage dnarange-setallows you to define the current ID range for a specified server:
# ipa-replica-manage dnarange-set masterA.example.com 1250-1499
ipa-replica-manage dnanextrange-setallows you to define the next ID range for a specified server:
# ipa-replica-manage dnanextrange-set masterB.example.com 1001-5000
0value; the SSSD service does not handle the
ipa idrange-findcommand. Run the
ipa idrange-find -hcommand to display help for how to use