Hi, this patch contains a fix for https://fedorahosted.org/sssd/ticket/2692. If uses the SDAP_SASL_AUTHID config option because it already contains the right NetBIOS name in the AD case. I basically tested the patch on a host with a long hostname. Without the patch I see: [ad_gpo_connect_done] (0x0400): sam_account_name is LONG-HOSTNAME-GPO-TEST$ with the patch it is changed to [ad_gpo_connect_done] (0x0400): sam_account_name is LONG-HOSTNAME-G$ and gpo's are found and downloaded. It would be nice is someone can do a regression test on a host with a shorter name as well. With this patch the only remaining caller for sss_krb5_get_primary() is in the same source file. Shall it be made static and removed from sss_krb5.h? bye, Sumit