Where do the large UID and GID (around 1.5 billion) of an AD user on Linux come from?
SSSD computes them from the user's Windows SID (ID mapping), so every joined Linux host gets the same numbers without storing anything in AD.
* The domain part of the SID chooses the range, the RID is added: the same UID on every host. *
getent passwd sysing01@g001.ckteck.com shows something like sysing01@g001.ckteck.com:*:1499401107:1499400513:…. AD users have no Unix UID. Windows identifies them by a SID (Security Identifier): the domain's SID plus a per-object RID (relative ID).
SSSD's ID mapping:
- hashes the domain part of the SID to choose a slice in a large ID range,
- adds the RID to the start of that slice.
So the result is deterministic. Every host computes the same UID for the same user, which matters as soon as files are shared between machines (NFS, backups). The GID ending in 513 is no accident: 513 is the RID of the Domain Users group, the user's primary group in AD.
The alternative is to store real POSIX attributes (uidNumber, gidNumber) in AD and set ldap_id_mapping = False. That needs more administration but gives readable numbers.
Go deeper:
Debian manpage: sssd-ad(5) — the ID MAPPING section and the ldap_id_mappingoption.- Wikipedia: Security Identifier — how a SID is built from authority, domain and RID.