SSSD 1.12.2 Active Directory inconsistent group membership

[Isaiah Houston]

Hi,
I am having a hard time tracking down an issue with SSSD 1.12.2 on Amazon Linux (Amazon
Linux only recently added SSSD to their yum repository, and 1.12.2 is the highest
available version). My user can authenticate to a Samba 4 directory server, but once
logged in, the “id” or “groups” command only displays the primary group, in this case the
“Domain Users” group:


uid=1115600500(administrator@[domain]) gid=1115600513(domain users@[domain])
groups=1115600513(domain users@[domain])

I want additional group memberships to be displayed so I can do things like allow members
of the Domain Admins group to have sudo access. Via ldapsearch, I can see that my user is
correctly a member of additional groups. If I stop the sssd service, delete files in
/var/lib/sss/mc and /var/lib/sss/db, and restart the service, all the groups are listed
correctly:


uid=1115600500(administrator@[domain]) gid=1115600513(domain users@[domain])
groups=1115600513(domain users@[domain]),1115600512(domain
admins@[domain]),1115600518(schema admins@[domain]),1115600519(enterprise
admins@[domain]),1115600520(group policy creator owners@[domian]),1115600572(denied rodc
password replication group@[domain])


However, as soon as I log out and log back in, the problem occurs again and persists until
I repeat the process of deleting the sssd cached files and restarting sssd. This is my
sssd.conf file:


[sssd]

domains = [domain]

config_file_version = 2

services = nss, pam


[domain/[domain]]

ad_domain = [domain]

krb5_realm = [domain]

realmd_tags = manages-system joined-with-samba

cache_credentials = False

id_provider = ad

krb5_store_password_if_offline = False

default_shell = /bin/bash

ldap_id_mapping = True

ldap_schema = ad

use_fully_qualified_names = True

fallback_homedir = /home/%d/%u

access_provider = ad


An additional issue is that sometimes when I log in, the login process fails to complete.
In the messages log, I see the following:


kernel: [344799.794025] sssd_be[13204]: segfault at 10000 ip 00007f7b73965144 sp
00007ffe53541e70 error 4 in libsss_idmap.so.0.4.0[7f7b73962000+5000]

sssd[be[domain]]: Starting up


However, this does not always happen. I am not sure if this issue is related, but since it
segfaults when calling idmap I suspect they are.


Any ideas on what to do next would be appreciated!