(Comment from BZ)
This issue is related to the magic private group (mpg) code which makes sure that with algorithmic id-mapping users from AD (sub-domain users) are automatically assigned a user private group. Since the private groups does not exists as a real group a lookup for this group uses a fallback to a user lookup.

If now the user private group is looked up while the cached user entry is exprired the backend first tries to find a matching group fails and falls back to a user lookup. Now two issues happen. First the user is looked up in the Global Catalog which will remove attribute from the cache which are not replicated to the Global Catalog, e.g. the shell or a home directory defined in AD. Second the code which adds the home directory attribute to the cache user object was not able to find the user object because the original request was a group lookup and the used call to search the cache was not aware of MPGs.

Reproducer:

[root@f26-ipa ~]# systemctl stop sssd.service ; rm -f /var/log/sssd/* ; rm -f /var/lib/sss/db/* ; systemctl start sssd.service                                                                                                                
[root@f26-ipa ~]# getent passwd tu1@ad.devel 
tu1@ad.devel:*:1367201104:1367201104:t u:/home/ad.devel/tu1:/bin/sh                                                                                                                                                                           
[root@f26-ipa ~]# sss_cache -E                                                                                                                                                                                                                
[root@f26-ipa ~]# getent group 1367201104                                                                                                                                                                                              
tu1@ad.devel:*:1367201104:                                                                                                                                                                                                                    
[root@f26-ipa ~]# getent passwd tu1@ad.devel                                                                                                                                                                                                  
tu1@ad.devel:*:1367201104:1367201104:t u:/:

PR: https://github.com/SSSD/sssd/pull/582

Commit ad6ab352 relates to this ticket

Commit e66517dc relates to this ticket

Commit 03222156 relates to this ticket

Commit 8aa56a9e relates to this ticket

• master:
• ad6ab35
• e66517d
• 0322215
• 8aa56a9

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4755

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.