Issue

Adding a group with 32Bit idrange fails with error.

Steps to Reproduce

1. ipa config-mod --addattr ipaconfigstring=SubID:Disable
2. ipa idrange-del FEDORA.TEST_subid_range

Range name: FEDORA.TEST_subid_range
First Posix ID of the range: 2147483648
Number of IDs in the range: 2147352576
First RID of the corresponding RID range: 2147283648
Domain SID of the trusted domain: S-1-5-21-738065-838566-3681614079
Range type: Active Directory domain range

1. ipactl restart ; sssctl restart
2. ipa idrange-add FEDORA.TEST__upper_32bit_range --base-id=2147483648 --range-size=10000 --rid-base=300000000 --secondary-rid-base=500000000 --type=ipa-local
3. [root@master ~]# ipa idrange-find

[root@server ~]# ipa idrange-find

2 ranges matched

Range name: FEDORA.TEST_id_range
First Posix ID of the range: 1629000000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range type: local domain range

Range name: FEDORA.TEST__upper_32bit_range
First Posix ID of the range: 2147483648
Number of IDs in the range: 10000
First RID of the corresponding RID range: 300000000
First RID of the secondary RID range: 500000000
Range type: local domain range

1. Now add ipauser and ipa group with 32bit idrange.

Actual behavior

[root@server ~]# ipa user-add ipauser1 --first=ipauser1 --last=s --uid=2147483649 --gid=2147483649

Added user "ipauser1"

User login: ipauser1
First name: ipauser1
Last name: s
Full name: ipauser1 s
Display name: ipauser1 s
Initials: is
Home directory: /home/ipauser1
GECOS: ipauser1 s
Login shell: /bin/sh
Principal name: ipauser1@FEDORA.TEST
Principal alias: ipauser1@FEDORA.TEST
Email address: ipauser1@fedora.test
UID: 2147483649
GID: 2147483649
Password: False
Member of groups: ipausers
Kerberos keys available: False

[root@server ~]# id ipauser1
uid=2147483649(ipauser1) gid=2147483649(ipauser1) groups=2147483649(ipauser1)

[root@server ~]# ipa group-add grp32bit --gid 2147483650
ipa: ERROR: invalid 'gid': can be at most 2147483647

Expected behavior

groupadd for 32bit idranges needs to work as well, since while adding users with --gid option with 32bit idrange works.

Version/Release/Distribution

freeipa-server-4.12.5-3.fc42.x86_64

Additional info: