I have sssd set up and doing cross-domain AD authentication.  I'm using the simple access provider and conferring login access per group.  Occasionally per user.

I notice that if I do a basic 'realm permit <user>', that it adds this user to the wrong AD domain:

Example:

realm permit processehcprofiler

adds it to my JAPN.COMPANY.COM AD domain, not my local AD domain (AMER).

If I attempt to do to 

realm permit -R AMER.COMPANY.COM processehcprofiler@AMER.COMPANY.COM

I get this error:

Through various experimentation, I find that if I do this:

I notice my "domain" entries in /etc/sssd/sssd.conf file are all lower case:

I'm used to Kerberos where domain names are uc and account names are lc.  So to do:

I have to re-write all the domain names in my sssd.conf file to uc?

Spike