There seem to be a bug in the relation between user private groups and public groups. When a user is created, the private group is created with same GID as the users UID. Looks OK until I create a public group with the same GID. Read on.

# ipa user-add user1 --uid=50201 --first="User" --last="Name"
------------------
Added user "user1"
------------------
  User login: user1
  First name: User
  Last name: Name
  Full name: User Name
  Display name: User Name
  Initials: UN
  Home directory: /home/user1
  GECOS field: user1
  Login shell: /bin/bash
  Kerberos principal: user1@IX.TEST.COM
  UID: 50201

# ipa group-find --private --gid=50201
---------------
1 group matched
---------------
  Group name: user1
  Description: User private group for user1
  GID: 50201
----------------------------
Number of entries returned 1
----------------------------

# ipa group-add group1 --gid=50201 --desc="Group1"
--------------------
Added group "group1"
--------------------
  Group name: group1
  Description: Group1
  GID: 50201

So far so good, but look what happens when I use getent to get the GID for the user private group and the public group:

# getent group group1
group1:*:50201:
# getent group user1
user1:*:378400003:

A random GID has been selected for the user private group.

If I do this the other way around, creating a new user, then looking up the GID for the users private group using getent, followed by creating a group with the same GID, and looking up the groups GID using getent, the result is reversed. Also if I look up the public group using ipa group-find a different GID is returned than what was returned by getent. All this happens without a single error or warning from IPA.

# ipa user-add user2 --uid=50202 --first="User" --last="Name"
------------------
Added user "user2"
------------------
  User login: user2
  First name: User
  Last name: Name
  Full name: User Name
  Display name: User Name
  Initials: UN
  Home directory: /home/user2
  GECOS field: user2
  Login shell: /bin/bash
  Kerberos principal: user2@IX.TEST.COM
  UID: 50202


# getent group user2
user2:*:50202:



# ipa group-add group2 --gid=50202 --desc="Group2"
--------------------
Added group "group2"
--------------------
  Group name: group2
  Description: Group2
  GID: 50202


# getent group user2
user2:*:50202:


# getent group group2
group2:*:378400004:


# ipa group-find group2
---------------
1 group matched
---------------
  Group name: group2
  Description: Group2
  GID: 50202
----------------------------
Number of entries returned 1
----------------------------