Update:
I had the Unix guy add a GID to the group. The group scope is set to
"Domain.local" and one of our "Unix Admins" said the group needed to
have it set to "universal". Which I have not yet done.
However, I am getting 60% success rate logging in.
If anyone has any advice on what I can grep from the log files that would help me find the
issue here, that would help.
running tcpdump shows that the AD server (i'm using DNS to resolve them) I connect
to, doesn't show consistency. IE: out of 4-5 IPs it's connecting to, some
IP's show both successful logins and failures. That to me, eliminates flaky AD
response - and maybe highlights a network issue.
Is there anything on the SSSD side I can inspect to see if the linux config itself might
be an issue?