search for: ldap_user_geco

...= sub ldap_user_object_class = user ldap_user_name = cn ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_user_shell = loginShell ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_objectsid = objectSid ldap_user_member_of = memberOf ldap_user_gecos = cn ldap_group_search_base = DC=EXAMPLE,DC=COM?subtree?&(objectclass=group)(gidnumber=*) ldap_group_objectsid = objectSid ldap_group_member = member ldap_group_object_class = group ldap_group_uuid = objectGUID ldap_group_nesting_level = 0 krb5_auth_timeout = 5 krb5_renew_interval = 60 krb5_...

Actually it isn't part of AD at all. We are using FreeIPA and Samba. We just finally figured this out with the help of some folks at Red Hat. It turned out there was a bug in one of the libraries that came along with sssd (sssd-libwbclient I believe). Their suggestion to use winbind and the version of the same library that came with it seems to have solved our problem instantly. It

...ANY.COM] ??????? id_provider = ad ??????? access_provider = ad ??????? sudo_provider = none ??????? ldap_id_mapping = false ??????? fallback_homedir = /home/%u ??????? default_shell = /bin/bash ??????? skel_dir = /etc/skel ??????? krb5_keytab=/etc/krb5.sssd.keytab ??????? enumerate = true ??????? ldap_user_gecos = description ??????? cache_credentials = false ??????? ldap_enumeration_refresh_timeout = 30 ? If you need some more infos please let me know but I think I just missed an option to activate it?