Description of problem:

IdM setup with ID mapping. The users RID(e.g. 655845) would be mapped to
UID(e.g. 3000003). Unfortunately, accessing kerberos ticket fails as below...

$ klist
klist: Invalid UID in persistent keyring name while getting default ccache

It appears the UID in persistent keyring still points to RID resolved from AD.
We tried with FILE:/ type, however, the file is created with usual RID instead
of UID.

$ ls -l /tmp/krb5ccache_posixuser -n
-rw------- 1 655845 655845 161 Jul 18 11:02 /tmp/krb5ccache_posixuser


Version-Release number of selected component (if applicable):

RedHat Enterprise Linux 7.4
sssd
IPA/AD Trust


How reproducible:

 # ipa idview-add test_view
  # ipa idoverrideuser-add test_view 'jstephen\posixuser' --uid=300003
  # ipa idview-apply test_view --hostgroups=allipasystems

==================================================

[root@rhel7-ipa-client ~]# getent passwd posixuser@jstephen.local
posixuser@jstephen.local:*:300003:10000:posixuser:/home/jstephen.local/posixuse
r:/bin/bash
[root@rhel7-ipa-client ~]# ssh posixuser@jstephen.local@localhost
Password:
Last login: Mon Aug 28 12:07:28 2017 from ::1
[posixuser@jstephen.local@rhel7-ipa-client ~]$ klist
klist: Invalid UID in persistent keyring name while getting default ccache
[posixuser@jstephen.local@rhel7-ipa-client ~]$ echo $KRB5CCNAME
KEYRING:persistent:10001



Actual results:

klist
klist: Invalid UID in persistent keyring name while getting default ccache

Expected results:

There shouldn't be any error.


Additional info: