<div dir="ltr">SSSD is able to evaluate group membership, but if for instance I create a view for my user and I add a ssh public key I can only use it to login passwordless in the IPA server, not on an IPA client. The password still works, but I see nothing in the sssd logs that explains why the pubkey was rejected on the IPA client. Could be that the client is not really aware that there is a view override? I thought that the external mapping would facilitate this..</div><div class="gmail_extra"> <div class="gmail_quote">On Mon, Jul 13, 2015 at 11:46 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, 13 Jul 2015, Angelo Pantano wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I have the same entry there, my question is that I don't understand why it doesn't it give me any visibility of the AD users mapped in that group, I mean I just see that entry, but what's that supposed to do? It doesn't really change anything with or without, I am missing the supposed value of having the AD users mapped in a FreeIPA posix group. I was expecting to see the AD users in that group, but I got nothing.. I'm a bit confused </blockquote> Read the documentation. Once you added AD user or group as external member of an external IPA group and then added this group as a member of IPA POSIX group, the user belonging to AD group would appear as a member of IPA POSIX group: # id administrator@adx.test uid=1878600500(administrator@adx.test) gid=1878600500(administrator@adx.test) groups=1878600500(administrator@adx.test),1878600520(group policy creator owners@adx.test),1878600519(enterprise admins@adx.test),1878600512(domain admins@adx.test),1878600518(schema admins@adx.test),1878600513(domain users@adx.test),1634400007(ad_admins) You wouldn't see this in the web UI because web UI is showing what is in the LDAP, not what is visible in the system when SSSD evaluates the group membership. -- / Alexander Bokovoy </blockquote></div> </div>