Thanks for confirming. Sounds like a failure to follow the docs. Here is what I have for
groups:
1. AD user is a member of "AD Group".
2. There is an ipa group called ad_users_external. It has been mapped to "AD
Group", and you can see the correct SID of this "AD group" listed under
External Members.
3. There is an ipa group called ad_users. It is internal, and ad_users_external is a
member of this group.
Is additional configuration required?
Thanks for your time :)
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Monday, February 11, 2019 11:34 AM, John Keates via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
I think the issue is outlined in the PAC error you got.
> On 11 Feb 2019, at 16:51, D via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> sss_send_pac failed, group membership for user with principal [<my
username>(a)AD.DOMAIN.COM] might not be correct.
It seems to indicate that the PAC in the ticket doesn’t match with the User+Group
membership combo that was expected.
John