When uninstalling replicas currently unused ID ranges are simply lost. On a 2 replica server setup uninstalling an reinstalling a replica may loose as much as half of the total original range.
We need to add means to reclaim unused ranges by adding them back to one of the masters when a replica is uninstalled or forcibly deleted.
Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=910453 (Red Hat Enterprise Linux 7)
It would appear that 389-ds doesn't include any procedure for doing this. Asking for advice on the 389-users list. I suspect that this is going to be rather dangerous to do in an automated way. Ranges would still be lost if the master to be deleted is down.
I wonder if a standalone tool to manage ranges would be better, or augment ipa-replica-manage.
389-ds defines an on-deck range for the case where the main DNA range runs out. This is defined by the "dnaNextRange" attribute, which takes a value in the form "<start>-<end>.
Nathan suggested using that rather than trying to incorporate the range back into the mix.
Note too that a master doesn't get a range at all until it adds its first user. It is possible we could also simply move the range from one master to another.
I think we'd probably need a tool as well for the case where all masters already have an on-deck range. The range would get lost and we'd need to provide a way to find/manage it.
See also ticket https://fedorahosted.org/freeipa/ticket/591, my proposal to add ipa-replica-manage commands may cover this.
attachment freeipa-rcrit-1088-dnarange.patch
Move all uncompleted tickets to next month bucket.
master: 9005b9b
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=921186
Metadata Update from @simo: - Issue assigned to rcritten - Issue set to the milestone: FreeIPA 3.2 - 2013/03
Login to comment on this ticket.