SSSD/AD on RHEL 6: Secondary groups not always returned with id command

Issue

We have integrated SSSD with Active Directory on RHEL6.6. We have observed that sometimes, secondary groups are returned by the id command, while other times only the primary group (domain users) is returned. This breaks the ad_access_filter and sudo rules that rely on those groups being present.