On ti, 27 helmi 2018, Ronald Wimmer via FreeIPA-users wrote:
for demonstration purposes I added two users to an external group that
already contained an AD group. The AD group had a human readable name.
The users as well.
When I removed these two users the AD group name changed from the
human readable name to the group SID. Why did that happen? Is there a
way to make the human readable name to reappear without re-adding the
Internally in LDAP we store SIDs of the external group members, not
names. We resolve them back to names when displaying them in CLI or Web
UI. We use SSSD-provided API for that.
If name resolution fails, it means that SSSD was unable to resolve SID
to name for the user. You can enable debug logs for SSSD to find out a
reason for that. If an AD domain is marked offline due to inability to
reach domain controllers from SSSD side, this might be one of reasons.
/ Alexander Bokovoy