I'm trying to integrate SUSE Linux (version 11 Patch level 2) with Microsoft Active Directory(AD) using the SSSD version 1.9.4 for making AD groups available to the Linux OS subsystem (SSSD is not used for authentication)

I've added the "sss" as a source for "passwd", "group", "shadow" within the "/etc/nsswitch.conf" file.

I'm seeing SSSD return inconsistent results while fetching the User/Group information through "id" / "getent" commands. It appears that we are facing this inconsistency only while SSSD interacts with Domain Controller with version Windows Server 2008 R2, and not while SSSD is interacting with Windows Server 2003 R2 based domain controller.

Please find the response/output from Linux host (terminal) as below:

1) For Windows Server 2008 R2 based Domain Controller controller@indelappvm02:~> id user_hadoop_3001 uid=2763510(user_hadoop_3001) gid=100513(Domain Users) groups=100513(Domain Users),2816151(Mygroups-hadoop-GED_KPI),2115887,2812298(Mygroups-hadoop-DAS_ANALYST),2812208(Mygroups-hadoop-CV_US),2809985(Mygroups-hadoop-DB_TICKET),2816149(Mygroups-hadoop-TLM),2827118(Mygroups-hadoop-DAS_ALL),2819228(Mygroups-hadoop-IMAGINE_GED_LON),2820642(Mygroups-hadoop-IMHOTEP),2812212(Mygroups-hadoop-OPEX),2024985,2356240,2358411,2100126,2115932,2099 968,2337579,1743308,1463380,2100236,1881724,1707456

As can be seen above, certain GIDs are displayed though these are not relevant to the user. When I query the same user again in the same session, I get the correct results without the additional GIDs. The problem re-appears when the cache has been cleared and the command is re-run.

2) For Windows Server 2003 R2 based Domain Controller controller@indelappvm02:~> id user_hadoop_3001 uid=2763510(user_hadoop_3001) gid=100513(Domain Users) groups=100513(Domain Users),2816151(Mygroups-hadoop-GED_KPI),2812208(Mygroups-hadoop-CV_US),2819228(Mygroups-hadoop-IMAGINE_GED_LON),2827118(Mygroups-hadoop-DAS_ALL),2812298(Mygroups-hadoop-DAS_ANALYST),2809985(Mygroups-hadoop-DB_TICKET),2816149(Mygroups-hadoop-TLM),2820642(Mygroups-hadoop-IMHOTEP),2812212(Mygroups-hadoop-OPEX)

The results are always accurate.

Would appreciate your inputs in helping solve this problem in case you have encountered this in your environment.

SSSD config is attached.

Regards, Prajwal