mart-w/kanidm
1
0
Fork 0
mirror of https://github.com/kanidm/kanidm.git synced 2025-02-24 04:57:00 +01:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Add workaround for podman subid issue (#491)

Browse source
This commit is contained in:
Firstyear 2021-06-25 17:08:20 +10:00 committed by GitHub
parent 9f5d8540fa
commit e209904d53
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
kanidm_book/src/posix_accounts.md
View file

@ -68,7 +68,9 @@ autoallocation policy and the simplicity of its design, while larger enterprises
will already have IDM or Business process applications for HR/People that are will already have IDM or Business process applications for HR/People that are
capable of supplying this kind of data in batch jobs. capable of supplying this kind of data in batch jobs.
## Enabling Posix Attributes on Accounts ## Enabling Posix Attributes
### Enabling Posix Attributes on Accounts
To enable posix account features and ids on an account, you require the permission `idm_account_unix_extend_priv`. To enable posix account features and ids on an account, you require the permission `idm_account_unix_extend_priv`.
This is provided to `idm_admins` in the default database. This is provided to `idm_admins` in the default database.
@ -84,7 +86,7 @@ You can view the accounts posix token details with:
kanidm account posix show --name anonymous demo_user kanidm account posix show --name anonymous demo_user
## Enabling Posix Attributes on Groups ### Enabling Posix Attributes on Groups
To enable posix group features and ids on an account, you require the permission `idm_group_unix_extend_priv`. To enable posix group features and ids on an account, you require the permission `idm_group_unix_extend_priv`.
This is provided to `idm_admins` in the default database. This is provided to `idm_admins` in the default database.
@ -101,3 +103,18 @@ You can view the accounts posix token details with:
Posix enabled groups will supply their members as posix members to clients. There is no Posix enabled groups will supply their members as posix members to clients. There is no
special or separate type of membership for posix members required. special or separate type of membership for posix members required.
## Troubleshooting Common Issues
### Subid conflicts with Podman
Due to the way that podman operates, in some cases using non-root containers with
kanidm accounts may fail with an error such as:
ERRO[0000] cannot find UID/GID for user NAME: No subuid ranges found for user "NAME" in /etc/subuid
This is a fault in podman and how it attempts to provide non-root containers, when uid/gids
are greater than 65535. In this case you may manually allocate your users gidnumber to be
between 1000 - 65535 which may not have the fault.