<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Title content=""><meta name=Keywords content=""><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Arial;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:Calibri'>Hey Jeff, that is also happening here, however only with users created after the ipa-adtrust-install. For example, the admin user fails to ever be authenticated despite numerous password resets, yet if I were to create a new account and reset it’s password it works fine.<o:p></o:p></span></p><div><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:-5.4pt;border-collapse:collapse'><tr><td width=0 style='width:.3pt;padding:0in 0in 0in 0in'></td><td width=30 style='width:22.5pt;padding:0in 0in 0in 0in'></td><td width=357 style='width:267.75pt;padding:0in 0in 0in 0in'></td></tr><tr><td width=0 style='width:.3pt;padding:0in 0in 0in 0in'></td><td width=30 style='width:22.5pt;padding:0in 0in 0in 0in'></td><td width=357 style='width:267.75pt;padding:0in 0in 0in 0in'></td></tr></table></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:Calibri'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:Calibri'><o:p> </o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-family:Calibri;color:black'>From: </span></b><span style='font-family:Calibri;color:black'>Jeff Goddard <jgoddard@emerlyn.com><br><b>Date: </b>Wednesday, February 8, 2017 at 11:21 AM<br><b>To: </b>Alexander Bokovoy <abokovoy@redhat.com><br><b>Cc: </b>Armaan Esfahani <armaan.esfahani@advancedopen.com>, <freeipa-users@redhat.com><br><b>Subject: </b>Re: [Freeipa-users] Where is SID stored after ipa-adtrust-install?<o:p></o:p></span></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>I had this same issue and the value was only added after a password change.<o:p></o:p></p></div><p class=MsoNormal>Jeff<o:p></o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Feb 8, 2017 at 11:10 AM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>On ke, 08 helmi 2017, Armaan Esfahani wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>I’ve been having issues with some of my IPA seemingly not getting SID’s<br>after the install, even after running with the –add-sids modifier. I<br>was wondering where the SID values are located so that I can take a<br>look at what’s happening/<o:p></o:p></p></blockquote><p class=MsoNormal>In the user object itself, ipaNTSecurityIdentifier attribute.<br><br>If you have SIDs not generated, there are two potential issues that<br>cause it:<br>- sidgen plugin configuration looking at wrong basedn<br>- ID ranges you have do not allow to map UID/GID to SID<br><br>If you ran ipa-adtrust-install --add-sids and it generated nothing, look<br>at /var/log/dirsrv/slapd-INSTANCE/errors log file. There should be at<br>least two lines:<br><br>[01/Feb/2017:14:28:24.189906631 +0100] sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ...<br>[01/Feb/2017:14:28:24.192039515 +0100] sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [0].<br><br>If there are any errors causing issues with SID generation, they will be<br>in between these two lines.<span style='color:#888888'><br><br><br><span class=hoenzb>-- </span><br><span class=hoenzb>/ Alexander Bokovoy</span><br><br><span class=hoenzb>-- </span><br><span class=hoenzb>Manage your subscription for the Freeipa-users mailing list:</span><br><span class=hoenzb><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span><br><span class=hoenzb>Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project</span></span><o:p></o:p></p></blockquote></div><p class=MsoNormal style='margin-bottom:12.0pt'><br><br clear=all><o:p></o:p></p></div></div></div></div></body></html>