[Freeipa-users] Unable to resolve AD users from IPA clients

[Jakub Hrozek]

On Wed, Jan 04, 2017 at 04:19:04PM +0100, Jan Karásek wrote:
> Hi, 
> thank you for help. 
> 
> I have tried to add 
> 
> subdomain_inherit = ignore_group_members 
> ignore_group_members = True 
> 
> into sssd.conf on server but problem still persists. 
> 
> >By the way, did you install 7.3 cleanly or did you upgrade? 
> It has been upgraded. 
> 
> >D id you ever removed the cache post-upgrade on the server? 
> Yes I did it couple of times both on server and client 
> 
> I find out that when client return value from id it differ from id output on server: 

I'm sorry but I would need to see the whole logs to give a qualified
answer, really. Could you please remove or invalidate the caches on the
server and the client, then run:
    date; id tst99655 at example.com; date
and then attach or send directly to me the logs from both the server and
the client so I can match the logs with the date timestamps?

Feel free to obfuscate the domain, user and group names in the logs.