Issue

The requirement was to create a POSIX group, ad_users and map AD users to it, and use the ad_users group for access control.

The ad_users group definition:

# ipa group-show ad_users
  Group name: ad_users
  Description: Active Directory Based Users
  GID: 232400009
  Member groups: ad_users_external

The ad_users_external group was created with the --external option, and was defined as:

# ipa group-show ad_users_external
  Group name: ad_users_external
  Description: External AD Users
  Member of groups: ad_users
  External member: S-1-5-21-3489640283-776466771-1133130440-513

The domain users AD group was a member of this group,

Looking up the group with the command failed:

# getent group ad_users

As a result of this the group was undefined on the IPA clients, and could not be used for access control.