What were you trying to do that didn't work?

ipa sidgen task with user UID >= 2^31, should fail with error 'ID value too large', as we don't support IDs over 32 bit, and range between 2^31 and 2^32 is reserved for subids.

If ID is bigger than UINT_MAX, int overflows, and ID is considered to be ID = original_ID % UINT_MAX

Please provide the package NVR for which bug is seen:

ipa-server-4.9.12

How reproducible:

always

Steps to reproduce

1. Create a user, then run

ldapmodify -D "cn=Directory Manager" -W << EOF 
dn: uid=username,cn=users,cn=accounts,$SUFFIX
changetype: modify 
replace: uidNumber 
uidNumber: 4294967306
EOF

1. Run sigden task, we don't see the correct error, but 

[16/Feb/2024:14:40:08.246024960 +0100] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [10] into an unused SID.{code}

Expected results

We should see error  'ID value too large'

Actual results

We don't see correct error

Improvement proposition

We should log the faulty ID, too. 

Analysis

 if (uid_number >= UINT32_MAX || gid_number >= UINT32_MAX) {
       LOG_FATAL("ID value too large.\n");
       ret = LDAP_CONSTRAINT_VIOLATION;
       goto done;
   }

Check should be against INT_MAX, not UINT_MAX. In order to prevent overflow, we can check if it's a good idea to use long 64 bit value to read the ID from LDAP.

Cloned from https://issues.redhat.com/browse/RHEL-26070