Ok, i've activated logging for all sections, i'm missed section nss. I will upload log files next time if i run in trouble.

Michael

On ti, 03 heinä 2018, Michael Gusek via FreeIPA-users wrote:

Hi Alexander,

its SSSD, we check it with id -u user@example.com.

Then you need to gather logs from SSSD on IPA master.
Basically, add

debug_level = 9

in domain and nss sections to /etc/sssd/sssd.conf and restart sssd.

Logs will be large so it would be good to gather them and put somewhere.

General troubleshooting notes apply:
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html