Thanks Sumit, that seems to have sorted it out. I had to stop the service, delete the
sssd database and then start the service for this to work.
From other tests prior to this, I noticed if I changed the UID for the users with id 10000
and 10001 this also got rid of the error and allowed the group names to be seen via
'id' and in file permissions. I guess the initial mistake here is having users
with the same ID as posix groups in 389. I think I'll probably end up permanently
changing these two UIDs anyway as it seems like it should never have been configured that
way in the first place, but good to know about the auto_private_groups setting.
Thanks,
Mark