hi,
reposting with zipped log.
we have a trust between an AD forest (2016) and an RHEL 7 Idm environment.
We have this ad group:
$ ipa group-show d-xxx-platform-admins
Group name: d-xxx-platform-admins
Description: AD d-xxx-platform-admins
External member: d-xxx-platform-admins@ad.local
Member of groups: xxx-platform-admins
When I run the command getent group xxx-platform-admins on the kdc, I get the full list of users in the AD group:
$ getent group xxx-platform-admins
xxx-platform-admins:*:1679450504:a-user1@ad.local,a-user2@ad.local,a-user3@ad.local,a-user4@ad.local,a-user5@ad.local,a-user6@ad.local,a-user7@ad.local,a-user8@ad.local,a-user9@ad.local,a-user10@ad.local,a-user11@ad.local,a-user12@ad.local,a-user12@ad.local,a-user13@ad.local,a-user14@ad.local,a-user15@ad.local,a-user16@ad.local
but on the idm client:
# getent group xxx-platform-admins
xxx-platform-admins:*:1679450504:a-user1@ad.local,a-user2@ad.local
Attached the sssd_nss.log with debuggging enabled.
Thanks in advance.