Thanks for confirming. Sounds like a failure to follow the docs. Here is what I have for groups:

1. AD user is a member of "AD Group".
2. There is an ipa group called ad_users_external. It has been mapped to "AD Group", and you can see the correct SID of this "AD group" listed under External Members.
3. There is an ipa group called ad_users. It is internal, and ad_users_external is a member of this group.

Is additional configuration required?

Thanks for your time :)

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Monday, February 11, 2019 11:34 AM, John Keates via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

I think the issue is outlined in the PAC error you got.


On 11 Feb 2019, at 16:51, D via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

sss_send_pac failed, group membership for user with principal [<my username>@AD.DOMAIN.COM] might not be correct.

It seems to indicate that the PAC in the ticket doesn’t match with the User+Group membership combo that was expected.

John