On Mon, 2012-08-13 at 20:01 +0200, Jakub Hrozek wrote:
It's an interface towards initgroups(3) or getgrouplist(3).
I'm not sure if the glibc folks did ever give a meaningful explanation
on the change. I can't even think of a good reason why initgroups should
differ from groups.
Their answer is that they want initgroups() lookups to stop by default
on the first matching provider so as not to waste time looking
elsewhere. Of course, this is completely broken if you want to mix local
and remote groups for a user. For this situation, they tell you to use
the line I copied above. Commenting out the option does something
similar under the hood.
Either adding sss to the initgroups list or commenting out the
initgroups line completely is fine. Authconfig comments the line out,
for what it's worth.