I'm running CentOS 7, fully updated with SSSD
version 1.11.2. I used realm to setup SSSD and everything seems
to be working fine for authentication. I'm even able to filter
access based on an ldap group. My id and access providers are
both set to ad.
When I try to run: id username, all I get is the "domain
users" group listed as the primary group. However, if I run
something like: getent group test-group, and then again run id
on a user in that group, test-group now shows up in the list
along with domain users.
While I don't particularly care about the output from id,
I'm seeing the same behavior when trying to use ACLs. The
scenario is the same as above. Before getent group
test-group, the users do not have access via ACL to files. As
soon as I run getent, everything starts working as it should.
I have tried enumerate = true in sssd.conf and confirmed
sss is in nsswitch.conf where it should be, but I cannot seem
to make remote groups work.
I suspect I'm missing something very small, but I've been
searching manuals, google, and the logs for days and I haven't
found any solution yet. I would appreciate any suggestions
anyone might have.