I found this while I explicitly skipped tokenGroups lookups for trusted
domains with the IPA provider. So I think there is currently no
reproducer with un-modified code. Nevertheless I think it's an issue
which should be fixed.
I've noticed under 1.9.4 that starting with an empty cache, doing a getent group does not return all members of the group, sometimes.
The actual group in AD contains some users and some subgroups of users. Not nested deeply, but multiple subgroups...
If I do a
getent group group1
when the cache is fresh it does not return all members. If I do a getent passwd on one of my accounts as a member of group1 and then follow that with a getent group group1 it will return all the members of the group. If I getent passwd account2 (also a member of group1) it does not help getent group return all members.