fedora-infrastructure

#11740 new users cannot login
Closed: Fixed by abompard. Opened by kevin.

Closed: Fixed
Reopen Issue

At first new users couldn't be activated from stage users with: 

[2024-01-25 20:42:36,771] ERROR in registration: An unhandled error BadRequest happened while activating stage user tcrider: Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.

So, I looked and there were no ranges assigned: 

ipa01.iad2.fedoraproject.org: No range set
ipa03.iad2.fedoraproject.org: No range set
ipa02.iad2.fedoraproject.org: No range set

I was unsure if I could just add existing ranges to them, so I made a new one: 

[14:30:47] <nirik> ipa idrange-add FEDORAPROJECT.ORG_third_id_range --base-id=1500600001 --range-size=600000
[14:30:47] <nirik> ipa-replica-manage dnarange-set ipa01.iad2.fedoraproject.org 1500600001-1500800000
[14:30:47] <nirik> ipa-replica-manage dnarange-set ipa02.iad2.fedoraproject.org 1500800001-1501000000
[14:30:47] <nirik> ipa-replica-manage dnarange-set ipa03.iad2.fedoraproject.org 1501000001-1501200000

And now new users can activate, but they cannot login.

I see:

[14:37:56] <nirik> [25/Jan/2024:22:30:07.877990308 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 521]: Cannot convert Posix ID [1500600001] into an unused SID.
[14:37:56] <nirik> [25/Jan/2024:22:30:07.879038493 +0000] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 149]: Cannot add SID to new entry.

So, we need to enable/add SID to the new range, but it's not super clear how to do that.

So please read https://freeipa.readthedocs.io/en/latest/designs/id-mapping.html for a general overview and https://freeipa.readthedocs.io/en/latest/designs/adtrust/sidconfig.html for SID generation.

@abompard and I did already go once over this but because replicas were reinstalled and also original master was replaced, you have lost all the details.

Typically, primary master holds full DNA range, then first replica gets half of that range allocated on a first 'give me a dynamically allocated ID' request, then next replica gets half of the range -- depending from which system it was created it would be half of the original remaining range or half of the range from the first replica, and so on.

DNA range on the master should then be set to a range that covers entire original ID range. Replicas should get their own allocation. I don't think what you did with DNA ranges is correct, it needs more proper overview.

See also https://access.redhat.com/articles/7027037 for a bit more hands-on documentation from Red Hat's support team.

If I understand correctly, the third idrange that Kevin has created is missing the RID, no?

# ipa idrange-find
----------------
5 ranges matched
----------------
  Range name: early_accounts
  First Posix ID of the range: 100000
  Number of IDs in the range: 100000
  First RID of the corresponding RID range: 1800000
  First RID of the secondary RID range: 1900000
  Range type: local domain range
  Range name: FEDORAPROJECT.ORG_id_range
  First Posix ID of the range: 1494200000
  Number of IDs in the range: 200000
  First RID of the corresponding RID range: 1000
  First RID of the secondary RID range: 201000
  Range type: local domain range
  Range name: FEDORAPROJECT.ORG_second_id_range
  First Posix ID of the range: 1500000000
  Number of IDs in the range: 600000
  First RID of the corresponding RID range: 500000
  First RID of the secondary RID range: 1101000
  Range type: local domain range
  Range name: FEDORAPROJECT.ORG_subid_range
  First Posix ID of the range: 2147483648
  Number of IDs in the range: 2147352576
  First RID of the corresponding RID range: 2147283648
  Domain SID of the trusted domain: S-1-5-21-738065-838566-2375993892
  Range type: Active Directory domain range
  Range name: FEDORAPROJECT.ORG_third_id_range
  First Posix ID of the range: 1500600001
  Number of IDs in the range: 600000
  Range type: local domain range

I'll set it and see if it works.

Hmm, looks like I can't easily do that:

# ipa idrange-mod FEDORAPROJECT.ORG_third_id_range --rid-base 2000000 --secondary-rid-base=2600000
ipa: ERROR: This command can not be used to change ID allocation for local IPA domain. Run `ipa help idrange` for more information

You should be using ldapmodify -- see the KCS https://access.redhat.com/articles/7027037

Oh yeah I remember now. I've applied:

dn: cn=FEDORAPROJECT.ORG_third_id_range,cn=ranges,cn=etc,dc=fedoraproject,dc=org
changetype: modify
add: ipabaserid
ipabaserid: 2000000
-
add: ipasecondarybaserid
ipasecondarybaserid: 2600000

via ldapmodify -D "cn=Directory Manager" -W -x -f ldif/add-rid-range.ldif on ipa01. Let's check now.

Nope, still doesn't work. I can register, set my password, but then I still can't login.
I ipa02's logs:

[26/Jan/2024:08:36:29.770295326 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 483]: ID value too large.
[26/Jan/2024:08:36:29.772713622 +0000] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 149]: Cannot add SID to new entry.
[26/Jan/2024:08:37:15.070373902 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 521]: Cannot convert Posix ID [1500800008] into an unused SID.
[26/Jan/2024:08:37:15.071286031 +0000] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 149]: Cannot add SID to new entry.

New user ID is 1500800008, so it should be into

  Range name: FEDORAPROJECT.ORG_third_id_range
  First Posix ID of the range: 1500600001
  Number of IDs in the range: 600000
  First RID of the corresponding RID range: 2000000
  First RID of the secondary RID range: 2600000
  Range type: local domain range
Edited by abompard

The sidgen plugin loads ranges once, on first use. This means that a change to ID ranges would not be reflected until dirsrv restart.

Restarted, I can login now with my newly register user! :tada:

I still see this in the logs:

[26/Jan/2024:09:26:39.642827386 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 483]: ID value too large.
[26/Jan/2024:09:26:39.643899245 +0000] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 149]: Cannot add SID to new entry.

But it may have been because of another user. I'll try to enable debug logging to verify this hypothesis.

This is due to 'uidNumber: -1' in staged user. That is a known issue I provided PR upstream this week: https://github.com/freeipa/freeipa/pull/7177

Oh, yeah of course. Thanks. Looks like this issue is fixed then.

Metadata Update from @abompard:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.