FreeIPA not accepting SubID Range

Rocky Linux Help & Support
1

So I’ve had to create a second custom Subordinate ID range. It’s created, but it still won’t let my users kinit to their account. Subordinate IDs are fully created, but I see this error:

[13/Feb/2026:09:03:33.171178086 -0500] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 533]: Cannot convert Posix ID [1326] into an unused SID on entry

UIDs in the range of 1000-5999 are all affected, and they are in the newly created range. The other range, which starts at UID 6000 seems to work without a problem.

This is for all users in that newly created range. Not sure how to fix this, save for destroying and recreating the account over again, but I don’t know if that’s the fix. Any clues on how to clean this up?

2

Removing the account and recreating it (in the same range) is not going to solve this. What are the other messages before and after this? In majority of cases, there are supposed to be find_sid_for_id messages, sidgen_task_thread messages, rid_to_sid_with_check.

3

Oddly, it seems my fix was “a little patience”. Whatever was not letting the SubID part to work just needed some time to propagate? Anyway, it seems to have worked just fine when I came into the office this morning. So I’m going to sip my coffee and contemplate the mysteries of the universe for a while.