I verified that Universal and Global groups work properly. Thank you for the information,
this is definitely the issue.
I have one final question, I am able to see all of the group members in a 'domain
local' group that has been placed into an IPA external group and then into a posix
group on the IPA server, but not the clients. For example, on the server:
[root@ipa0 ~]# getent group linux_team(a)ipa.engr.tamu.edu
linux_team@ipa.engr.tamu.edu:*:662759310:coe-william.luke@engr.tamu.edu,coe-andrew.eggleston@engr.tamu.edu,coe-blake.dworaczyk@engr.tamu.edu,coe-david.miller@engr.tamu.edu,coe-j.polasek@engr.tamu.edu,coe-matthew.mjelde@engr.tamu.edu,coe-steve.herring@engr.tamu.edu,coe-william.luke@engr.tamu.edu
But on the client:
[root@ipa-test ~]# getent group linux_team(a)ipa.engr.tamu.edu
linux_team@ipa.engr.tamu.edu:*:662759310:
Is the fact that I can see the group members on the IPA server despite being in a domain
local group just a fluke? I can reproduce this with other groups as well. If I was able to
do the same thing on the clients my problems would likely be solved.