Thanks, I'll check it out. 

On Sun, Jul 8, 2018 at 2:30 PM Michael Ströder <michael@stroeder.com> wrote:
Disclaimer: I did not follow this thread closely.

On 07/08/2018 08:06 PM, Spike White wrote:
> Yes, most of the groups missing when I set 'ldap_use_tokengroups = true'
> are universal groups.

I vaguely remember that Volker said something about this in his FOSDEM talk:

https://fosdem.org/2018/schedule/event/samba_authentication_authorization/

See slide 12 of his presentation especially:

"Domain Controllers calculate membership at login time"

This could be the cause of your issues.

Ciao, Michael.