Description of problem: Even though SSSD filters out AD domain local groups, members from those groups from time to time end up in the SSSD cache. This results in inconsistent group memberships across different systems. The ask is to verify that no code path in SSSD is evaluating those AD domain local groups. This is related to https://bugzilla.redhat.com/show_bug.cgi?id=2025667 and specifically to https://bugzilla.redhat.com/show_bug.cgi?id=2025667#c21: """ About "why does it sometimes work?", SSSD will read all groups from AD even "domain local" groups, e.g. to map the SID to the group name or other purposes. Additionally if we only have the SID the group must be read to determine the scope. If the scope is "domain local" SSSD ignored this group on purpose when determine the group memberships of the user. But it might be possible that during other request which involve the group the group members are read an associated with the group, although they should have been ignored. """ Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.