[SSSD-users] SSSD : id don't display groups name subdomain (Child trust)

Hi everyone, In dev environnement, with SSSD 1.16.2 (release 13.el7_6.5) on RHEL 7.6 SSSD is configured to request on mch.dev domain. trusted subdomain sub.mch.dev exist (Win2k16) On mch.dev, I have an user 'user1' in Universal groups 'G_TEST' and 'allowed_ssh'. These groups are placed also in mch.dev domain. On sub.mch.dev, I have user 'user2' only. 'user2' is place in 'G_TEST' and 'allowed_ssh'. When get id user from mch.dev domain, by `id mch\user1` I get this result : `uid=83701115(user1) gid=513(sssdgrp) groups=513(sssdgrp),83701107(allowed_ssh),83701117(g_test)`, but `id sub\user2`, in same group (universal - child trust), I get `uid=69901104(user2) gid=69901104(user2) groups=69901104(user2)` without group name getent work fine : `getent group 'g_test'` result : `g_test:*:83701117:user2,user1,mch` Why I have not groupname for user2 ? sssd.conf : [sssd] domains = mch.dev config_file_version = 2 services = nss, pam default_domain_suffix = mch.dev full_name_format = %1$s [nss] filter_users = root reconnection_retries = 3 entry_cache_nowait_percentage = 75 [pam] pam_pwd_expiration_warning = 21 pam_account_expired_message = Account/password expired, please use selfservice portal to change your password and logon again. [domain/MCH.DEV] debug_level = 9 id_provider = ad access_provider = ad auth_provider = ad ad_domain = mch.dev krb5_realm = MCH.DEV krb5_store_password_if_offline = True cache_credentials = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True override_gid = 513 fallback_homedir = /home/%u@%d default_shell = /bin/bash dyndns_update = false ldap_idmap_range_min = 100000 ldap_use_tokengroups = False krb5.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_ccache_name = KEYRING:persistent:%{uid} default_realm = MCH.DEV [realms] MCH.DEV = { } [domain_realm] mch.dev = MCH.DEV .mch.dev = MCH.DEV Logs available here: https://pastebin.com/Ntt62Cxt Thanks in advance @Jakub Hrozek jhrozek@redhat.com<mailto:jhrozek@redhat.com> With the configuration above, Inverse of your problem : I can't view and use group for sub domain user, but I can login with SSH like this : 'ssh -l 'sub\user2' 172.31.8.88'