Issue

• SSSD is configured to use Kerberos and LDAP.
• AD admin created a new group for us and populated UNIX attributes with a GID.
• On Linux client machine we see that sudo is failing with error that user is not in sudoers file, even though we have an include file that set to allow user to execute command via sudo by virtue of being a member of the new group.
• We are able to do a look up on the group via sssd and net ads search. However the GID field is unavailable when net ads is used and getent does not bring back any results by group name or GID.
• Is there a range to gid assignment in play here? Is it defined on the client?