I'm running CentOS 7, fully updated with SSSD version 1.11.2.  I used realm to setup SSSD and everything seems to be working fine for authentication.  I'm even able to filter access based on an ldap group.  My id and access providers are both set to ad.

When I try to run: id username, all I get is the "domain users" group listed as the primary group.  However, if I run something like: getent group test-group, and then again run id on a user in that group, test-group now shows up in the list along with domain users.

While I don't particularly care about the output from id, I'm seeing the same behavior when trying to use ACLs.  The scenario is the same as above.  Before getent group test-group, the users do not have access via ACL to files.  As soon as I run getent, everything starts working as it should.

I have tried enumerate = true in sssd.conf and confirmed sss is in nsswitch.conf where it should be, but I cannot seem to make remote groups work.

I suspect I'm missing something very small, but I've been searching manuals, google, and the logs for days and I haven't found any solution yet.  I would appreciate any suggestions anyone might have.

Thanks,
Peter

--
Peter Kirby
System and Database Administrator @ Harding University