[SSSD-users] Re: groups

[Jakub Hrozek]

On Mon, Apr 10, 2017 at 05:49:24PM +0000, Thomas Beaudry wrote:
>  Hi,
>  
>  
>  Sometimes when I ssh to a Ubuntu machine that is using sssd to connect to a windows AD, I
> get the following error:
>  
>  
>  groups: cannot find name for group ID 891504278
>  groups: cannot find name for group ID 891504279
>  groups: cannot find name for group ID 891504280
>  groups: cannot find name for group ID 891504527
>  
>  This problem doesn't always happen (maybe 1 out of 10 logins).  Is there a way to
> troubleshoot this?  Or cache this group information?
>   
SSSD always caches, that's how it works, the data is always first stored
into the cache by the sssd_be process and then read by sssd_nss.

The way you'd debug this is to enable debug level for the nss and domain
sections and also perhaps run ldbsearch for this GID, something like:
    ldbsearch -H /var/lib/sss/db/cache_$domain.ldb
'(&(objectclass=group)(gid=891504278))'