mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-02 08:59:57 -06:00
David Hanina
b36c163fe8
Provides simple warning when creating new user with uid out of all local ranges, as this is the main culprit of breaking Kerberos, by not generating ipantsecurityidentifier. We don't have to check for user-mod, because modification never changes ipantsecurityidentifier. We do not have to check groups, as groups are ignored for ipa without AD trust. It's reasonable to revisit this in the future for group creation and warn against groups out of ranges as well as warn for users with groups without SID, in case AD trust is enabled. Fixes: https://pagure.io/freeipa/issue/9781 Signed-off-by: David Hanina <dhanina@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>