From 69cd05bf635d19b9844f65d83dace05136a40326 Mon Sep 17 00:00:00 2001

From: Christian Heimes <cheimes@redhat.com>

Date: Fri, 19 Mar 2021 11:48:38 +0100

Subject: [PATCH] Add basic support for subordinate user/group ids

New LDAP object class "ipaUserSubordinate" with four new fields:

- ipasubuidnumber / ipasubuidcount

- ipasubgidnumber / ipasgbuidcount

New self-service permission to add subids.

New command user-auto-subid to auto-assign subid

The code hard-codes counts to 65536, sets subgid equal to subuid, and

does not allow removal of subids. There is also a hack that emulates a

DNA plugin with step interval 65536 for testing.

Work around problem with older SSSD clients that fail with unknown

idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571

Related: https://pagure.io/freeipa/issue/8361

Signed-off-by: Christian Heimes <cheimes@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

---

 ACI.txt                                   |   2 +-

 API.txt                                   |  47 ++-

 Makefile.am                               |   2 +-

 VERSION.m4                                |   4 +-

 doc/designs/index.rst                     |   1 +

 doc/designs/subordinate-ids.md            | 468 ++++++++++++++++++++++

 freeipa.spec.in                           |   1 +

 install/share/60basev2.ldif               |   1 +

 install/share/60basev4.ldif               |  19 +

 install/share/Makefile.am                 |   1 +

 install/share/bootstrap-template.ldif     |  22 +

 install/share/dna.ldif                    |  20 +

 install/tools/Makefile.am                 |   2 +

 install/tools/ipa-subids.in               |   8 +

 install/ui/src/freeipa/user.js            |  53 ++-

 install/updates/20-indices.update         |  18 +

 install/updates/73-subid.update           | 102 +++++

 install/updates/Makefile.am               |   1 +

 ipalib/constants.py                       |  13 +

 ipaserver/install/adtrustinstance.py      |  29 +-

 ipaserver/install/dsinstance.py           |  43 +-

 ipaserver/install/ipa_subids.py           | 154 +++++++

 ipaserver/install/ldapupdate.py           |  95 +++--

 ipaserver/plugins/baseuser.py             | 274 ++++++++++++-

 ipaserver/plugins/idrange.py              |  10 +-

 ipaserver/plugins/internal.py             |  12 +

 ipaserver/plugins/user.py                 |  17 +-

 ipatests/prci_definitions/gating.yaml     |  12 +

 ipatests/test_integration/test_subids.py  | 201 ++++++++++

 ipatests/test_xmlrpc/test_range_plugin.py |   7 +

 31 files changed, 1565 insertions(+), 75 deletions(-)

 create mode 100644 doc/designs/subordinate-ids.md

 create mode 100644 install/share/60basev4.ldif

 create mode 100644 install/tools/ipa-subids.in

 create mode 100644 install/updates/73-subid.update

 create mode 100644 ipaserver/install/ipa_subids.py

 create mode 100644 ipatests/test_integration/test_subids.py

diff --git a/ACI.txt b/ACI.txt

index 05852cf6c0150db7d8de99a5f7a44e538df29e5e..fce02a333b212de9b61f920515eed3e356b1391b 100644

--- a/ACI.txt

+++ b/ACI.txt

@@ -375,7 +375,7 @@ aci: (targetattr = "audio || businesscategory || carlicense || departmentnumber

 dn: dc=ipa,dc=example

 aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || loginshell || modifytimestamp || objectclass || uid || uidnumber")(target = "ldap:///cn=users,cn=compat,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read User Compat Tree";allow (compare,read,search) userdn = "ldap:///anyone";)

 dn: cn=users,cn=accounts,dc=ipa,dc=example

-aci: (targetattr = "ipasshpubkey || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)

+aci: (targetattr = "ipasshpubkey || ipasubgidcount || ipasubgidnumber || ipasubuidcount || ipasubuidnumber || ipauniqueid || ipauserauthtype || userclass")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User IPA Attributes";allow (compare,read,search) userdn = "ldap:///all";)

 dn: cn=users,cn=accounts,dc=ipa,dc=example

 aci: (targetattr = "krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalexpiration || krbprincipalname || krbprincipaltype || nsaccountlock")(targetfilter = "(objectclass=posixaccount)")(version 3.0;acl "permission:System: Read User Kerberos Attributes";allow (compare,read,search) userdn = "ldap:///all";)

 dn: cn=users,cn=accounts,dc=ipa,dc=example

diff --git a/API.txt b/API.txt

index 212ef807c771794dc2f89eb89e03b669eb49295b..262b4d6a72c7d7032a7027116f7a4f65aa620615 100644

--- a/API.txt

+++ b/API.txt

@@ -4974,7 +4974,7 @@ output: Entry('result')

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: PrimaryKey('value')

 command: stageuser_add/1

-args: 1,45,3

+args: 1,46,3

 arg: Str('uid', cli_name='login')

 option: Str('addattr*', cli_name='addattr')

 option: Flag('all', autofill=True, cli_name='all', default=False)

@@ -4992,6 +4992,7 @@ option: Str('givenname', cli_name='first')

 option: Str('homedirectory?', cli_name='homedir')

 option: Str('initials?', autofill=True)

 option: Str('ipasshpubkey*', cli_name='sshpubkey')

+option: Int('ipasubuidnumber?', cli_name='subuid')

 option: Str('ipatokenradiusconfiglink?', cli_name='radius')

 option: Str('ipatokenradiususername?', cli_name='radius_username')

 option: StrEnum('ipauserauthtype*', cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened'])

@@ -5080,7 +5081,7 @@ output: Output('result', type=[<type 'dict'>])

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: ListOfPrimaryKeys('value')

 command: stageuser_find/1

-args: 1,58,4

+args: 1,60,4

 arg: Str('criteria?')

 option: Flag('all', autofill=True, cli_name='all', default=False)

 option: Str('carlicense*', autofill=False)

@@ -5104,6 +5105,8 @@ option: Str('ipanthomedirectory?', autofill=False, cli_name='smb_home_dir')

 option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])

 option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')

 option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')

+option: Int('ipasubgidnumber?', autofill=False, cli_name='subgid')

+option: Int('ipasubuidnumber?', autofill=False, cli_name='subuid')

 option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')

 option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')

 option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened'])

@@ -5145,7 +5148,7 @@ output: ListOfEntries('result')

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: Output('truncated', type=[<type 'bool'>])

 command: stageuser_mod/1

-args: 1,51,3

+args: 1,52,3

 arg: Str('uid', cli_name='login')

 option: Str('addattr*', cli_name='addattr')

 option: Flag('all', autofill=True, cli_name='all', default=False)

@@ -5167,6 +5170,7 @@ option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_d

 option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')

 option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')

 option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')

+option: Int('ipasubuidnumber?', autofill=False, cli_name='subuid')

 option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')

 option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')

 option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened'])

@@ -6058,7 +6062,7 @@ output: Entry('result')

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: PrimaryKey('value')

 command: user_add/1

-args: 1,46,3

+args: 1,47,3

 arg: Str('uid', cli_name='login')

 option: Str('addattr*', cli_name='addattr')

 option: Flag('all', autofill=True, cli_name='all', default=False)

@@ -6075,6 +6079,7 @@ option: Str('givenname', cli_name='first')

 option: Str('homedirectory?', cli_name='homedir')

 option: Str('initials?', autofill=True)

 option: Str('ipasshpubkey*', cli_name='sshpubkey')

+option: Int('ipasubuidnumber?', cli_name='subuid')

 option: Str('ipatokenradiusconfiglink?', cli_name='radius')

 option: Str('ipatokenradiususername?', cli_name='radius_username')

 option: StrEnum('ipauserauthtype*', cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened'])

@@ -6156,6 +6161,16 @@ option: Str('version?')

 output: Entry('result')

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: PrimaryKey('value')

+command: user_auto_subid/1

+args: 1,4,3

+arg: Str('uid', cli_name='login')

+option: Flag('all', autofill=True, cli_name='all', default=False)

+option: Flag('no_members', autofill=True, default=False)

+option: Flag('raw', autofill=True, cli_name='raw', default=False)

+option: Str('version?')

+output: Entry('result')

+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

+output: PrimaryKey('value')

 command: user_del/1

 args: 1,3,3

 arg: Str('uid+', cli_name='login')

@@ -6180,7 +6195,7 @@ output: Output('result', type=[<type 'bool'>])

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: PrimaryKey('value')

 command: user_find/1

-args: 1,61,4

+args: 1,63,4

 arg: Str('criteria?')

 option: Flag('all', autofill=True, cli_name='all', default=False)

 option: Str('carlicense*', autofill=False)

@@ -6204,6 +6219,8 @@ option: Str('ipanthomedirectory?', autofill=False, cli_name='smb_home_dir')

 option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])

 option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')

 option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')

+option: Int('ipasubgidnumber?', autofill=False, cli_name='subgid')

+option: Int('ipasubuidnumber?', autofill=False, cli_name='subuid')

 option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')

 option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')

 option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened'])

@@ -6247,8 +6264,23 @@ output: Output('count', type=[<type 'int'>])

 output: ListOfEntries('result')

 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

 output: Output('truncated', type=[<type 'bool'>])

+command: user_match_subid/1

+args: 1,8,4

+arg: Str('criteria?')

+option: Flag('all', autofill=True, cli_name='all', default=False)

+option: Int('ipasubuidnumber', autofill=False, cli_name='subuid')

+option: Flag('no_members', autofill=True, default=True)

+option: Flag('pkey_only?', autofill=True, default=False)

+option: Flag('raw', autofill=True, cli_name='raw', default=False)

+option: Int('sizelimit?', autofill=False)

+option: Int('timelimit?', autofill=False)

+option: Str('version?')

+output: Output('count', type=[<type 'int'>])

+output: ListOfEntries('result')

+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])

+output: Output('truncated', type=[<type 'bool'>])

 command: user_mod/1

-args: 1,52,3

+args: 1,53,3

 arg: Str('uid', cli_name='login')

 option: Str('addattr*', cli_name='addattr')

 option: Flag('all', autofill=True, cli_name='all', default=False)

@@ -6270,6 +6302,7 @@ option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_d

 option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')

 option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')

 option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')

+option: Int('ipasubuidnumber?', autofill=False, cli_name='subuid')

 option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')

 option: Str('ipatokenradiususername?', autofill=False, cli_name='radius_username')

 option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened'])

@@ -7183,10 +7216,12 @@ default: user_add_cert/1

 default: user_add_certmapdata/1

 default: user_add_manager/1

 default: user_add_principal/1

+default: user_auto_subid/1

 default: user_del/1

 default: user_disable/1

 default: user_enable/1

 default: user_find/1

+default: user_match_subid/1

 default: user_mod/1

 default: user_remove_cert/1

 default: user_remove_certmapdata/1

diff --git a/Makefile.am b/Makefile.am

index c5a33e67f56b2c6f9efb5b4c6af3f7a44ccbdb3c..321df05a7c44f32929a2c5ec45341a42105a8e2f 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -229,7 +229,7 @@ fasttest: $(GENERATED_PYTHON_FILES) ipasetup.py

 	    --ignore $(abspath $(top_srcdir))/ipatests/test_integration \

 	    --ignore $(abspath $(top_srcdir))/ipatests/test_xmlrpc

-fastlint: $(GENERATED_PYTHON_FILES) ipasetup.py

+fastlint: $(GENERATED_PYTHON_FILES) ipasetup.py acilint apilint

 if ! WITH_PYLINT

 	@echo "ERROR: pylint not available"; exit 1

 endif

diff --git a/VERSION.m4 b/VERSION.m4

index 9f024675f905a1ee771b6ff293c25b2ac46d92df..1c1e0d56c0eb5c15be0887fae9f90e399757acc7 100644

--- a/VERSION.m4

+++ b/VERSION.m4

@@ -86,8 +86,8 @@ define(IPA_DATA_VERSION, 20100614120000)

 #                                                      #

 ########################################################

 define(IPA_API_VERSION_MAJOR, 2)

-define(IPA_API_VERSION_MINOR, 242)

-# Last change: add status options for cert-find

+# Last change: add subordinate id feature

+define(IPA_API_VERSION_MINOR, 243)

 ########################################################

diff --git a/doc/designs/index.rst b/doc/designs/index.rst

index cbec1096c363c9c31656b05f22c50321cd45e073..6dd0edff3004fd0d19208f0c063d4156bde3bf91 100644

--- a/doc/designs/index.rst

+++ b/doc/designs/index.rst

@@ -17,3 +17,4 @@ FreeIPA design documentation

    membermanager.md

    hidden-replicas.md

    disable-stale-users.md

+   subordinate-ids.md

diff --git a/doc/designs/subordinate-ids.md b/doc/designs/subordinate-ids.md

new file mode 100644

index 0000000000000000000000000000000000000000..1b578667a8cfdda223af38a14d142c72a5d5c073

--- /dev/null

+++ b/doc/designs/subordinate-ids.md

@@ -0,0 +1,468 @@

+# Central management of subordinate user and group ids

+

+Subordinate ids are a Linux Kernel feature to grant a user additional

+user and group id ranges. Amongst others the feature can be used

+by container runtime engies to implement rootless containers.

+Traditionally subordinate id ranges are configured in ``/etc/subuid``

+and ``/etc/subgid``.

+

+To make rootless containers in a large environment as easy as pie, IPA

+gains the ability to centrally manage and assign subordinate id ranges.

+SSSD and shadow-util are extended to read subordinate ids from IPA and

+provide them to userspace tools.

+

+## Overview

+

+Feature requests

+

+* [FreeIPA feature request #8361](https://pagure.io/freeipa/issue/8361)

+* [SSSD feature request #5197](https://github.com/SSSD/sssd/issues/5197)

+* [shadow-util feature request #154](https://github.com/shadow-maint/shadow/issues/154)

+* [389-DS RFE for DNA plugin rhbz#1938239](https://bugzilla.redhat.com/show_bug.cgi?id=1938239)

+

+Man pages

+

+* [man subuid(5)](https://man7.org/linux/man-pages/man5/subuid.5.html)

+* [man subgid(5)](https://man7.org/linux/man-pages/man5/subgid.5.html)

+* [man user_namespaces(7)](https://man7.org/linux/man-pages/man7/user_namespaces.7.html)

+* [man newuidmap(1)](https://man7.org/linux/man-pages/man1/newuidmap.1.html)

+

+Articles / blog posts

+* [Basic Setup and Use of Podman in a Rootless environment](https://github.com/containers/podman/blob/master/docs/tutorials/rootless_tutorial.md)

+* [How does rootless Podman work](https://opensource.com/article/19/2/how-does-rootless-podman-work)

+

+## Design choices

+

+Some design choices are owed to the circumstance that uids and gids

+are limited datatypes. The Linux Kernel and userland defines

+``uid_t`` and ``gid_t`` as unsigned 32bit integers (``uint32_t``), which

+limits possible values for numeric user and group ids to

+``0 .. 2^32-2``. ``(uid_t)-1`` is reserved for error reporting. On the

+other hand the user ``nobody`` typically has uid 65534 / gid 65534. This

+means we need to assign 65,536 subordinate ids to every user. The

+theoretical maximum amount of subordinate ranges is less than 65,536

+(``65536 * 65536 == 2^32``). [``logins.def``](https://man7.org/linux/man-pages/man5/login.defs.5.html)

+also uses 65536 as default setting for ``SUB_UID_COUNT``.

+

+The practical limit is far smaller. Subordinate ids should not overlap

+with system accounts, local user accounts, IPA user accounts, and

+mapped accounts from Active Directory. Therefore IPA uses the upper

+half of the uid_t range (>= 2^31 == 2,147,483,648) for subordinate ids.

+The high bit is rarely used. IPA limits general numeric ids

+(``uidNumber``, ``gidNumber``, ID ranges) to maximum values of signed

+32bit integer (2^31-1) for backwards compatibility with XML-RPC.

+``logins.def`` defaults to ``SUB_UID_MAX`` 600,100,000.

+

+A default subordinate id count of 65,536 and a total range of approx.

+2.1 billion limits IPA to slightly more than 32,000 possible ranges. It

+may sound like a lot of users, but there are much bigger installations

+of IPA. For comparison Fedora Accounts has over 120,000 users stored in

+IPA.

+

+For that reason we treat subordinate id space as premium real estate

+and don't auto-map or auto-assign subordinate ids by default. Instead

+we give the admin several options to assign them manually, semi-manual,

+or automatically.

+

+### Revision 1 limitation

+

+The first revision of the feature is deliberately limited and

+restricted. We are aiming for a simple implementation that covers

+basic use cases. Some restrictions may be lifted in the future.

+

+* subuid and subgids cannot be set independently. They are always set

+  to the same value.

+* counts are hard-coded to value 65536

+* once assigned subids cannot be removed

+* IPA does not support multiple subordinate id ranges. Contrary to

+  ``/etc/subuid``, users are limited to one set of subordinate ids.

+* subids are auto-assigned. Auto-assignment is currently emulated

+  until 389-DS has been extended to support DNA with step interval.

+* subids are allocated from hard-coded range

+  ``[2147483648..4294901767]`` (``2^31`` to ``2^32-1-65536``), which

+  is the upper 2.1 billion uids of ``uid_t`` (``uint32_t``). The range

+  can hold little 32,767 subordinate id ranges.

+* Active Directory support is out of scope and may be provided in the

+  future.

+

+### Subid assignment example

+

+```

+>>> import itertools

+>>> def subids():

+...     for n in itertools.count(start=0):

+...         start = SUBID_RANGE_START + (n * SUBID_COUNT)

+...         last = start + SUBID_COUNT - 1

+...         yield (start, last)

+...

+>>> gen = subids()

+>>> next(gen)

+(2147483648, 2147549183)

+>>> next(gen)

+(2147549184, 2147614719)

+>>> next(gen)

+(2147614720, 2147680255)

+```

+

+The first user has 65565 subordinate ids from uid/gid ``2147483648``

+to ``2147549183``, the next user has ``2147549184`` to ``2147614719``,

+and so on. The range count includes the start value.

+

+An installation with multiple servers, 389-DS'

+[DNA](https://directory.fedoraproject.org/docs/389ds/design/dna-plugin.html)

+plug-in takes care of delegating and assigning chunks of subid ranges

+to servers. The DNA plug-in guarantees uniqueness across servers.

+

+## LDAP

+

+### LDAP schema extension

+

+The subordinate id feature introduces a new auxiliar object class

+``ipaSubordinateId`` with four required attributes ``ipaSubUidNumber``,

+``ipaSubUidCount``, ``ipaSubGidNumber``, and ``ipaSubGidCount``. The

+attributes with ``number`` suffix store the start value of the interval.

+The ``count`` attributes contain the size of the interval including the

+start value. The maximum subid is

+``ipaSubUidNumber + ipaSubUidCount - 1``.

+

+All four attributes are single-value ``INTEGER`` type with standard

+integer matching rules. OIDs ``2.16.840.1.113730.3.8.23.8`` and

+``2.16.840.1.113730.3.8.23.11`` are reserved for future use.

+

+```raw

+attributeTypes: (

+  2.16.840.1.113730.3.8.23.6

+  NAME 'ipaSubUidNumber'

+  DESC 'Numerical subordinate user ID (range start value)'

+  EQUALITY integerMatch ORDERING integerOrderingMatch

+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE

+  X-ORIGIN 'IPA v4.9'

+)

+attributeTypes: (

+  2.16.840.1.113730.3.8.23.7

+  NAME 'ipaSubUidCount'

+  DESC 'Subordinate user ID count (range size)'

+  EQUALITY integerMatch ORDERING integerOrderingMatch

+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE

+  X-ORIGIN 'IPA v4.9'

+)

+attributeTypes: (

+  2.16.840.1.113730.3.8.23.9

+  NAME 'ipaSubGidNumber'

+  DESC 'Numerical subordinate group ID (range start value)'

+  EQUALITY integerMatch ORDERING integerOrderingMatch

+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE

+  X-ORIGIN 'IPA v4.9'

+)

+attributeTypes: (

+  2.16.840.1.113730.3.8.23.10

+  NAME 'ipaSubGidCount'

+  DESC 'Subordinate group ID count (range size)'

+  EQUALITY integerMatch ORDERING integerOrderingMatch

+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE

+  X-ORIGIN 'IPA v4.9'

+)

+```

+

+The ``ipaSubordinateId`` object class is an auxiliar subclass of

+``top`` and requires all four subordinate id attributes as well as

+``uidNumber``. It does not subclass ``posixAccount`` to make

+the class reusable in idview overrides later.

+

+```raw

+objectClasses: (

+  2.16.840.1.113730.3.8.24.4

+  NAME 'ipaSubordinateId'

+  DESC 'Subordinate uid and gid for users'

+  SUP top AUXILIARY

+  MUST ( uidNumber $ ipaSubUidNumber $ ipaSubUidCount $ ipaSubGidNumber $ ipaSubGidCount )

+  X-ORIGIN 'IPA v4.9'

+)

+```

+

+The ``ipaSubordinateGid`` and ``ipaSubordinateUid`` are defined for

+future use. IPA always assumes the presence of ``ipaSubordinateId`` and

+does not use these object classes.

+

+```raw

+objectClasses: (

+  2.16.840.1.113730.3.8.24.2

+  NAME 'ipaSubordinateUid'

+  DESC 'Subordinate uids for users, see subuid(5)'

+  SUP top AUXILIARY

+  MUST ( uidNumber $ ipaSubUidNumber $ ipaSubUidCount )

+  X-ORIGIN 'IPA v4.9'

+ )

+objectClasses: (

+  2.16.840.1.113730.3.8.24.3

+  NAME 'ipaSubordinateGid'

+  DESC 'Subordinate gids for users, see subgid(5)'

+  SUP top AUXILIARY

+  MUST ( uidNumber $ ipaSubGidNumber $ ipaSubGidCount )

+  X-ORIGIN 'IPA v4.9'

+)

+```

+

+### Index

+

+The attributes ``ipaSubUidNumber`` and ``ipaSubGidNumber`` are index

+for ``pres`` and ``eq`` with ``nsMatchingRule: integerOrderingMatch``

+to enable efficient ``=``, ``>=``, and ``<=`` searches.

+

+### Distributed numeric assignment (DNA) plug-in extension

+

+Subordinate id auto-assignment requires an extension of 389-DS'

+[DNA](https://directory.fedoraproject.org/docs/389ds/design/dna-plugin.html)

+plug-in. The DNA plug-in is responsible for safely assigning unique

+numeric ids across all replicas.

+

+Currently the DNA plug-in only supports a step size of ``1``. A new

+option ``dnaStepAttr`` (name is tentative) will tell the DNA plug-in

+to use the value of entry attributes as step size.

+

+

+## Permissions, Privileges, Roles

+

+### Self-servive RBAC

+

+The self-service permission enables users to request auto-assignment

+of subordinate uid and gid ranges for themselves. Subordinate ids cannot

+be modified or deleted.

+

+* ACI: *selfservice: Add subordinate id*

+* Permission: *Self-service subordinate ID*

+* Privilege: *Subordinate ID Selfservice User*

+* Role: *Subordinate ID Selfservice Users*

+* role default member: n/a

+

+### Administrator RBAC

+

+The administrator permission allows privileged users to auto-assign

+subordinate ids to users. Once assigned subordinate ids cannot

+be modified or deleted.

+

+* ACI: *Add subordinate ids to any user*

+* Permission: *Manage subordinate ID*

+* Privilege: *Subordinate ID Administrators*

+* default privilege role: *User Administrator*

+

+

+## Workflows

+

+In the default configuration of IPA, neither existing users nor new

+users will have subordinate ids assigned. There are a couple of ways

+to assign subordinate ids to users.

+

+### User administrator

+

+Users with *User Administrator* role and members of the *admins* group

+have permission to auto-assign new subordinate ids to any user. Auto

+assignment can be performed with new ``user-auto-subid`` command on the

+command line or with the *Auto assign subordinate ids* action in the

+*Actions* drop-down menu in the web UI.

+

+```shell

+$ ipa user-auto-subid someusername

+```

+

+### Self-service for group members

+

+Ordinary users cannot self-service subordinate ids by default. Admins

+can assign the new *Subordinate ID Selfservice User* to users group to

+enable self-service for members of the group.

+

+For example to enable self-service for all members of the default user

+group ``ipausers``, do:

+

+```shell

+$ ipa role-add-member "Subordinate ID Selfservice User" --groups=ipausers

+```

+

+This allows members of ``ipausers`` to request subordinate ids with

+the ``user-auto-subid`` command or the *Auto assign subordinate ids*

+action in the web UI.

+

+```shell

+$ ipa user-auto-subid myusername

+```

+

+### Auto assignment with user default object class

+

+Admins can also enable auto-assignment of subordinate ids for all new

+users by adding ``ipasubordinateid`` as a default user objectclass.

+This can be accomplished in the web UI under "IPA Server" /

+"Configuration" / "Default user objectclasses" or on the command line

+with:

+

+```shell

+$ ipa config-mod --addattr="ipaUserObjectClasses=ipasubordinateid"

+```

+

+**NOTE:** The objectclass must be written all lower case.

+

+### ipa-subid tool

+

+Finally IPA includes a new tool for mass-assignment of subordinate ids.

+The command uses automatic LDAPI EXTERNAL bind when it's executed as

+root user. Other it requires valid Kerberos TGT of an admin or user

+administrator.

+

+```raw

+

+# /usr/libexec/ipa/ipa-subids --help

+Usage: ipa-subids

+

+Mass-assign subordinate ids

+

+Options:

+  --version             show program's version number and exit

+  -h, --help            show this help message and exit

+  --group=GROUP         Filter by group membership

+  --filter=USER_FILTER  Raw LDAP filter

+  --dry-run             Dry run mode.

+  --all-users           All users

+

+  Logging and output options:

+    -v, --verbose       print debugging information

+    -d, --debug         alias for --verbose (deprecated)

+    -q, --quiet         output only errors

+    --log-file=FILE     log to the given file

+

+# # /usr/libexec/ipa/ipa-subids --group ipausers

+Processing user 'testsubordinated1' (1/15)

+Processing user 'testsubordinated2' (2/15)

+Processing user 'testsubordinated3' (3/15)

+Processing user 'testsubordinated4' (4/15)

+Processing user 'testsubordinated5' (5/15)

+Processing user 'testsubordinated6' (6/15)

+Processing user 'testsubordinated7' (7/15)

+Processing user 'testsubordinated8' (8/15)

+Processing user 'testsubordinated9' (9/15)

+Processing user 'testsubordinated10' (10/15)

+Processing user 'testsubordinated11' (11/15)

+Processing user 'testsubordinated12' (12/15)

+Processing user 'testsubordinated13' (13/15)

+Processing user 'testsubordinated14' (14/15)

+Processing user 'testsubordinated15' (15/15)

+Processed 15 user(s)

+The ipa-subids command was successful

+```

+

+### Find and match users by any subordinate id

+

+The ``user-find`` command search by start value of subordinate uid and

+gid range. The new command ``user-match-subid`` can be used to find a

+user by any subordinate id in their range.

+

+```raw

+$ ipa user-match-subid --subuid=2153185287

+  User login: asmith

+  First name: Alice

+  Last name: Smith

+  ...

+  SubUID range start: 2153185280

+  SubUID range size: 65536

+  SubGID range start: 2153185280

+  SubGID range size: 65536

+----------------------------

+Number of entries returned 1

+----------------------------

+$ ipa user-match-subid --subuid=2153185279

+  User login: bjones

+  First name: Bob

+  Last name: Jones

+  ...

+  SubUID range start: 2153119744

+  SubUID range size: 65536

+  SubGID range start: 2153119744

+  SubGID range size: 65536

+----------------------------

+Number of entries returned 1

+----------------------------

+```

+

+## SSSD integration

+

+* base: ``cn=accounts,$SUFFIX`` / ``cn=users,cn=accounts,$SUFFIX``

+* scope: ``SCOPE_SUBTREE`` (2) / ``SCOPE_ONELEVEL`` (1)

+* user filter: should include ``(objectClass=posixAccount)``

+* attributes: ``uidNumber ipaSubUidNumber ipaSubUidCount ipaSubGidNumber ipaSubGidCount``

+

+SSSD can safely assume that only *user accounts* of type ``posixAccount``

+have subordinate ids. In the first revision there are no other entries

+with subordinate ids. The ``posixAccount`` object class has ``uid``

+(user login name) and ``uidNumber`` (numeric user id) as mandatory

+attributes. The ``uid`` attribute is guaranteed to be unique across

+all user accounts in an IPA domain.

+

+The ``uidNumber`` attribute is commonly unique, too. However it's

+technically possible that an administrator has assigned the same

+numeric user id to multiple users. Automatically assigned uid numbers

+don't conflict. SSSD should treat multiple users with same numeric

+user id as an error.

+

+The attribute ``ipaSubUidNumber`` is always accompanied by

+``ipaSubUidCount`` and ``ipaSubGidNumber`` is always accompanied

+by ``ipaSubGidCount``. In revision 1 the presence of

+``ipaSubUidNumber`` implies presence of the other three attributes.

+All four subordinate id attributes and ``uidNumber`` are single-value

+``INTEGER`` types. Any value outside of range of ``uint32_t`` must

+treated as invalid. SSSD will never see the DNA magic value ``-1``

+in ``cn=accounts,$SUFFIX`` subtree.

+

+IPA recommends that SSSD simply extends its existing query for user

+accounts and requests the four subordinate attributes additionally to

+RFC 2307 attributes ``rfc2307_user_map``. SSSD can directly take the

+values and return them without further processing, e.g.

+``uidNumber:ipaSubUidNumber:ipaSubUidCount`` for ``/etc/subuid``.

+

+Filters for additional cases:

+

+* subuid filter (find user with subuid by numeric uid):

+  ``&((objectClass=posixAccount)(ipaSubUidNumber=*)(uidNumber=$UID))``,

+  ``(&(objectClass=ipaSubordinateId)(uidNumber=$UID))``, or similar

+* subuid enumeration filter:

+  ``&((objectClass=posixAccount)(ipaSubUidNumber=*)(uidNumber=*))``,

+  ``(objectClass=ipaSubordinateId)``, or similar

+* subgid filter (find user with subgid by numeric uid):

+  ``&((objectClass=posixAccount)(ipaSubGidNumber=*)(uidNumber=$UID))``,

+  ``(&(objectClass=ipaSubordinateId)(uidNumber=$UID))``, or similar

+* subgid enumeration filter:

+  ``&((objectClass=posixAccount)(ipaSubGidNumber=*)(uidNumber=*))``,

+  ``(objectClass=ipaSubordinateId)``, or similar

+

+## Implementation details

+

+* The four subid attributes are not included in

+  ``baseuser.default_attributes`` on purpose. The ``config-mod``

+  command does not permit removal of a user default objectclasses

+  when the class is the last provider of an attribute in

+  ``default_attributes``.

+* ``ipaSubordinateId`` object class does not subclass the other two

+  object classes. LDAP supports

+  ``SUP ( ipaSubordinateGid $ ipaSubordinateUid )`` but 389-DS only

+  auto-inherits from first object class.