Disclaimer: I did not follow this thread closely.
On 07/08/2018 08:06 PM, Spike White wrote:
> Yes, most of the groups missing when I set 'ldap_use_tokengroups = true'
> are universal groups.
I vaguely remember that Volker said something about this in his FOSDEM talk:
https://fosdem.org/2018/schedule/event/samba_authentication_authorization/
See slide 12 of his presentation especially:
"Domain Controllers calculate membership at login time"
This could be the cause of your issues.
Ciao, Michael.