hi,

reposting with zipped log.

we have a trust between an AD forest (2016) and an RHEL 7 Idm environment.

We have this ad group:

$ ipa group-show d-xxx-platform-admins
  Group name: d-xxx-platform-admins
  Description: AD d-xxx-platform-admins
  External member: d-xxx-platform-admins@ad.local
  Member of groups: xxx-platform-admins

When I run the command getent group xxx-platform-admins on the kdc, I get the full list of users in the AD group:

$ getent group xxx-platform-admins
xxx-platform-admins:*:1679450504:a-user1@ad.local,a-user2@ad.local,a-user3@ad.local,a-user4@ad.local,a-user5@ad.local,a-user6@ad.local,a-user7@ad.local,a-user8@ad.local,a-user9@ad.local,a-user10@ad.local,a-user11@ad.local,a-user12@ad.local,a-user12@ad.local,a-user13@ad.local,a-user14@ad.local,a-user15@ad.local,a-user16@ad.local

but on the idm client:

# getent group xxx-platform-admins
xxx-platform-admins:*:1679450504:a-user1@ad.local,a-user2@ad.local

Attached the sssd_nss.log with debuggging enabled.

Thanks in advance.

--
regards,
Natxo