The question is whether we want to support.

There can be some issue on samba server because it cause problem for me just sometimes.
And ATM just for one particular user

[root@fclient cifs]# klist 
Ticket cache: KEYRING:persistent:0:0
Default principal: smbuser01-2007983@SSSDAD2012R2.COM
Valid starting       Expires              Service principal
08/17/2017 12:03:51  08/17/2017 22:03:50  cifs/fserver-2007983.sssdad2012r2.com@SSSDAD2012R2.COM
        renew until 08/24/2017 12:03:49
08/17/2017 12:03:50  08/17/2017 22:03:50  krbtgt/SSSDAD2012R2.COM@SSSDAD2012R2.COM
        renew until 08/24/2017 12:03:49
[root@fclient cifs]# getcifsacl /mnt/samba/share1/testfile.660.1.txt
REVISION:0x1
CONTROL:0x9004
OWNER:S-1-22-1-599069283
GROUP:S-1-22-2-599000513
ACL:S-1-22-1-599069283:ALLOWED/0x0/RW
ACL:S-1-22-2-599000513:ALLOWED/0x0/RW
ACL:Everyone@WORLD AUTHORITY:ALLOWED/0x0/
[root@fclient cifs]# ls -l /mnt/samba/share1/testfile.660.1.txt
-rw-rw----. 1 smbuser01-2007983@sssdad2012r2.com domain users@sssdad2012r2.com 11 Aug 17 12:03 /mnt/samba/share1/testfile.660.1.txt
[root@fclient cifs]# ls -ln /mnt/samba/share1/testfile.660.1.txt
-rw-rw----. 1 599069283 599000513 11 Aug 17 12:03 /mnt/samba/share1/testfile.660.1.txt

S-1-22-{1,2}- are POSIX IDs for UID and GID correspondingly when user or group cannot be mapped otherwise. They are Samba SID extensions. See https://www.samba.org/samba/history/samba-3.0.23c.html for the announcement.

Translating them to UID/GID is easy -- RID of S-1-22-1- is the UID, RID of S-1-22-2- is the GID. Samba always adds these group membership SIDs.

S-1-22-{1,2}- are POSIX IDs for UID and GID correspondingly when user or group cannot be mapped otherwise. They are Samba SID extensions. See https://www.samba.org/samba/history/samba-3.0.23c.html for the announcement.

Yes and it's obvious from links in ticket description.

Translating them to UID/GID is easy -- RID of S-1-22-1- is the UID, RID of S-1-22-2- is the GID. Samba always adds these group membership SIDs.

Yes it is samba SID extension and it is not part of MSDN documentation. Therefore I wrote whether we want to support it. Mapping SID to [UG]ID will not be a problem. But it might be a problem to translate into name.

In my opinion, it costs little to be compatible with Samba here so why not supporting this. And a problem with sid2name is the same as with everything else. If you have ID available but not name, you'd do the same.

You'll get these SIDs as part of the MS-PAC produced by Samba AD DC. We might add the same to FreeIPA for consistency.

Samba does this when creating a local user token:

        /*
         * Add the "Unix Group" SID for each gid to catch mapped groups
         * and their Unix equivalent.  This is to solve the backwards
         * compatibility problem of 'valid users = +ntadmin' where
         * ntadmin has been paired with "Domain Admins" in the group
         * mapping table.  Otherwise smb.conf would need to be changed
         * to 'valid user = "Domain Admins"'.  --jerry
         *
         * For consistency we also add the "Unix User" SID,
         * so that the complete unix token is represented within
         * the nt token.
         */
        uid_to_unix_users_sid(session_info->unix_token->uid, &tmp_sid);
        add_sid_to_array_unique(session_info->security_token, &tmp_sid,
                                &session_info->security_token->sids,
                                &session_info->security_token->num_sids);
        for ( i=0; iunix_token->ngroups; i++ ) {
                gid_to_unix_groups_sid(session_info->unix_token->groups[i], &tmp_sid);
                add_sid_to_array_unique(session_info->security_token, &tmp_sid,
                                        &session_info->security_token->sids,
                                        &session_info->security_token->num_sids);
        }

I added https://pagure.io/freeipa/issue/7109 for FreeIPA.

In my opinion, it costs little to be compatible with Samba here so why not supporting this. And a problem with sid2name is the same as with everything else. If you have ID available but not name, you'd do the same.

sid2name is not a big issue because we can directly map SID to name (in GC)
However with S-1-22-1-599069283 it is a little a little bit complicated sid2name will consist of 2 steps (sid -> ID -> name) instead of 1 (SID -> name

Right. your sid2name turns into id2name for these SIDs. Not as straightforward but at least there is no real sid2id step here.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4509

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.