One way Trust with AD with ID Views for Groups is not working as expected

[Peter Tselios]

What I have: 
AD Domain: Example.com
IPA Domain lx.example.com
CentOS 7.9
sssd 1.16


IPA is a master a 2 replicas. All the machines have the following configuration: 
  Max domain level: 1
  Enabled server roles: CA server, IPA master, DNS server, NTP server, AD trust agent, AD
trust controller

We use ID Views for both Users and Groups in AD. 
Our issues are with the ID Views for the groups. 

We constantly get the following error: 

/usr/bin/id: cannot find name for group ID XXX

The XXX is the GID defined in the ID View of the user. 

The problem is resolved if I do one of the following: 

===============================
[username@ipa_client]: cd /home

ls -lrt
===============================

OR

getent group <GID>

OR 

getent group <ID View groupname>

OR 

getent group <ad_groupname@domain>

Of course, the issue is returning when cache is expired or when a **new** user that has
the same primary GID tries to login on a server. 
What kind of information would you need in order to help me to solve this issue?

[iulian roman]

I have a similar setup with  the same issue which I tried to solve/troubleshoot for months
without success. I have opened as well few threads on this list and sssd list. The funny
part starts with sssd 2.2 , where even the uid override which used to work  on sssd 1.6
does not work anymore .
The first suggestion was to check if a group name exist in AD for the GID you overwrite  -
in my case it was - therefore that didn't help.

[Peter Tselios]

All GID/group names exist in AD, obviously. 
And Ansible is used in order to ensure that the Names/IDs etc are the correct ones. 

I have read all the relevant threads here, but it looks like there is no clear solution on
this.