[389-users] getent netgroup <mynetgroup> yields no hits

Hello I would like to configure authentication and authorization via nisNetgroups in 389ds. With "getent" on the 389ds client I see my groups and my users. If I query the netgroup via "getent netgroup <my_netgroup>" I do not get any hit. My netgroup you see below. The log says: tail -f /var/log/dirsrv/slapd-localhost/access [29/Dec/2021:12:11:14.350690263 +0100] conn=851 op=13 SRCH base="ou=netgroup,dc=example,dc=com" scope=2 filter="(&(cn=qausers)(objectClass=nisNetgroup))" attrs="objectClass cn memberNisNetgroup nisNetgroupTriple modifyTimestamp [29/Dec/2021:12:11:14.351130562 +0100] conn=851 op=13 RESULT err=0 tag=101 nentries=0 wtime=0.000194950 optime=0.000443964 etime=0.000636159 The last entries mean: err=0: no error tag=101: it was a search nentries=0: no hits for the search But ldap search with the same parameters yields the netgroup: ldapsearch -x -D "cn=Directory Manager" -W -H ldaps://server.example.com -b ou=netgroup,dc=example,dc=com "(&(cn=qausers)(objectClass=nisNetgroup))" objectClass cn memberNisNetgroup nisNetgroupTriple modifyTimestamp dn: cn=qausers,ou=netgroup,dc=example,dc=com objectClass: nisNetgroup objectClass: top cn: qausers nisNetgroupTriple: (,alice,) nisNetgroupTriple: (,eve,) nisNetgroupTriple: (server.example.com,-,-) nisNetgroupTriple: (server,-,-) modifyTimestamp: 20211229105114Z I replaced the real server name by server.example.com and deleted all quotes. My nsswitch.conf contains netgroup: files ldap sss My sssd.conf contains: ldap_netgroup_search_base = ou=netgroup,dc=example,dc=com ldap_netgroup_object_class = nisNetgroup ldap_netgroup_triple = nisNetgroupTriple My 389ds-instance is created via cat instance.inf [general] config_version = 2 [slapd] root_password = my_pw [backend-userroot] sample_entries = yes suffix = dc=example,dc=com My client is configured via "authconfig-tui". I already looked for special, normally unseen characters in the config files with "cat -vet /etc/sssd/sssd.conf" and "cat -vet /etc/nsswitch.conf", but did not find any. Does it play a role, that the 389ds server and client see each other via entries in the /etc/hosts? I would assume "no", as getent can resolve both groups and users. Can you help? Best Regards, Tibor -- Tibor Dudas ICT-System-Ingenieur Enterprise Applications Abraxas Informatik AG The Circle 68 | CH-8058 Zürich-Flughafen Direkt +41 58 660 24 83 tibor.dudas(a)abraxas.ch | www.abraxas.ch [cid:image001.png@01D806C8.7DEA42C0]<https://www.abraxas.ch/de/>