On Wed, Nov 09, 2016 at 06:44:25AM -0000, Daniel Hermans wrote:
i'm using id_provider=ldap ( in fact everything id/auth/access
are all ldap )
Ah, then you alrady default to no token groups (unless you explicitly
chose tokengroups to be enabled) and I suspect you hit a
bug. You can file one on
https://fedorahosted.org/sssd/newticket
as 513 was obviously 'Domain Users' ( not sure where the '200' gets
prefixed? ) I ended up adding local group 'domainusers' with gid = 200513
I think this is the SSSD ID mapping picking up a range based on the
domain SID.
i suspect my group search base was too specific to pickup domain users ( trying to speed
up 'id -a' i have a tighter group_search_base ) - it's a large domain and
login can take 3-5 seconds to complete auth even with a more specific base
You can also experiment with upgrading to 1.14.x which contains some
performance enhancements, ignore_group_members or mounting the cache to
tmpfs.