freeipa

#9159 [RFE] ipa-client-install should provide option to enable subid: sss in /etc/nsswitch.conf
Closed: fixed by rcritten. Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 2068088

Description of problem:
ipa-client-install should provide an option allowing to configure subid managed at IPA level.
Currently, ipa-client-install configures the sssd profile which in turns customizes /etc/nsswitch.conf but the subid database does not use IPA and relies only on the local files /etc/subuid and /etc/subgid.
As it may not be relevant in all cases to configure "subid: sss", it would be nice to have a new option, and keep the default behavior without this option (=do not configure subuid: sss).
Version-Release number of selected component (if applicable):
subid feature was introduced in ipa-4.9.8
How reproducible:
Always
Steps to Reproduce:
1. install ipa client with ipa-client-install
2. grep subid /etc/nsswitch.conf
Actual results:
subid not configured to use sss
Expected results:
ipa-client-install should provide an option to configure NSS with subid: sss

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2068088

Issue linked to bug 2068088

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6266

master:

  • 571b6b81c3e79ddc89db07e99b12b3352294cffd Installer: add --subid option to select the sssd profile with-subid
  • 49ab92c5ef067e67ebe3d53711b027465c591760 man pages: document the --subid installer option
  • 952a77caef9cb21f1e7c794cd35217b58954744b ipatests: add new test with --subid installer option

ipa-4-9:

  • 74b2fd06d978d56137ccfde310f9c64187e0a5a3 Installer: add --subid option to select the sssd profile with-subid
  • e10f3385d0bbb4100a8220ce372dc2748f8b329e man pages: document the --subid installer option
  • 0193498f682eb3efa9cbdf82af215eaa854f466a ipatests: add new test with --subid installer option

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field changelog adjusted to IPA installers now provide the ability to configure SSSD as datasource for subid

master:

  • e3e7c98ac59442a053703a700432cc1739d4a8ac ipatests: ipa-client-install --subid adds entry in nsswitch.conf

ipa-4-9:

  • a5762621ef3ed1e699306a8d2eef634bc927a6fc ipatests: ipa-client-install --subid adds entry in nsswitch.conf

ipa-4-10:

  • a39af6b7228d8ba85b9e97aa5decbc056d081c77 ipatests: ipa-client-install --subid adds entry in nsswitch.conf

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2068088, https://bugzilla.redhat.com/show_bug.cgi?id=2094400 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2068088)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.