Hi All.
I'm struggling a bit trying to get sssd (client is RHEL7.2, so using
sssd-1.13.0-40.el7_2.1.x86_64) to connect to a large institutional AD (100k+ users, each
user belonging to dozens or even hundreds of groups). I'm following the instructions
here:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
The config file (redacted slightly) is at the bottom.
Most of the time, when I first login to the client system, using credentials from AD, the
only group I see is 'domain users'. It's quite slow to login (a couple of
minutes). When I interrogate the cache, the user I'm logging in as shows up against
many of the groups as 'ghost: username' (I don't know what this means), as
well as 'original_member:'.
When I run a simple 'groups username' against other users in the domain, I mostly
get just 'domain users', but sometimes (infrequently) it will a list the right set
of groups.
Can anyone provide some pointers on what I should be looking at to get the groups showing
up reliably?
Thanks,
Robert.
[sssd]
config_file_version = 2
domains =
ad.example.com
services = nss, pam, pac
debug_level = 7
[
domain/ad.example.com]
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = simple
simple_allow_users = crs, [...others...]
cache_credentials = true
debug_level = 7
[nss]
debug_level = 9
[pam]
[pac]
debug_level = 10