Hello all.

I have to interface with AD via ldap backend (can not join: it makes large redeploys quite problematic, having to give my own pass on every machine). Out of the many domains in the AD forest, I'm only interested in PERSONALE and STUDENTI. I can only manage OUs, groups and machine accounts in PERSONALE. My users come from both domains, but I'm only interested in memberships of groups in PERSONALE (those are 'universal' groups that contain users from both domains).

I currently use this sssd.conf file:
-8<--
[sssd]
config_file_version = 2
services = nss,pam
domains = studenti.domain.it,personale.domain.it
debug_level = 3
override_space = ^

[nss]
fallback_homedir = /home/%d/%u
default_shell = /bin/bash
debug_level = 3

[pam]
debug_level = 3

[domain/personale.domain.it]
override_homedir = /home/PERSONALE/%u
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_group_nesting_level = 5
ldap_uri = ldaps://personale.dir.unibo.it:3269
ldap_user_search_base = DC=personale,DC=domain,DC=it??
ldap_group_search_base = OU=REDACTED,DC=personale,DC=domain,DC=it??
ldap_default_bind_dn = CN=REDACTED,DC=personale,DC=domain,DC=it
ldap_default_authtok_type = password
ldap_default_authtok = REDACTED
ldap_user_object_class = person
ldap_group_object_class = group
ldap_user_fullname = displayName
ldap_schema = ad
ldap_referrals = False
#ldap_referrals = true
ldap_id_mapping = True
enumerate = false

# Caching settings
cache_credentials = true
entry_cache_user_timeout = 28800
entry_cache_group_timeout = 86400

ldap_id_use_start_tls = false
debug_level = 3
ldap_access_filter = (memberOf:1.2.840.113556.1.4.1941:=CN=REDACTED,DC=personale,DC=domain,DC=it)
case_sensitive = Preserving

[domain/studenti.domain.it]
override_homedir = /home/STUDENTI/%u
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_group_nesting_level = 5
# *MUST* use GlobalCatalog port or can't access a group in PERSONALE
ldap_uri = ldaps://studenti.domain.it:3269
ldap_user_search_base = DC=studenti,DC=domain,DC=it
# *NOPE*: see notes
#ldap_group_search_base = OU=REDACED,DC=personale,DC=domain,DC=it??

ldap_default_bind_dn = CN=REDACTED,DC=personale,DC=domain,DC=it
ldap_default_authtok_type = password
ldap_default_authtok = REDACTED
ldap_user_object_class = person
ldap_group_object_class = group
ldap_user_fullname = displayName
ldap_schema = ad
ldap_referrals = true
ldap_id_mapping = True
enumerate = false
cache_credentials = true
ldap_id_use_start_tls = false
debug_level = 3

ldap_access_filter = (memberOf:1.2.840.113556.1.4.1941:=CN=REDACTED,DC=domain,DC=it)

case_sensitive = Preserving
-8<--

* Order for "domains" is important: if I first lookup in PERSONALE, students are also assigned to PERSONALE.
* If I don't include STUDENTI domain in ldap_user_search_base for PERSONALE, "getent group" won't return group members from STUDENTI.
* If I specify "ldap_group_search_base" for STUDENTI, "getent group grpname" only returns group members that are in STUDENTI.

But while 'getent group grpname' returns all users (from both domains), 'id username' only returns groups from username's domain.

Is there a way to make sssd only consider groups in PERSONALE also for users in STUDENTI and return consistent results for both id and getent?

Tks.