Seeing a snippet of the logs to see what kind of a lookup this was would be nice.

(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_asq_search_parse_entry] (0x2000): Matched objectclass [user] on DN [CN=Billy Bob (856886),OU=Users,OU=SomeDept,DC=test,DC=domain,DC=com], will use associated map
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Billy Bob (856886),OU=Users,OU=SomeDept,DC=test,DC=domain,DC=com].
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [whenChanged]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [uSNChanged]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectGUID]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_asq_search_parse_entry] (0x2000): DN [CN=Billy Bob (856886),OU=Users,OU=SomeDept,DC=test,DC=domain,DC=com] did not match the objectClass [group]
(Thu Mar 14 14:34:40 2019) [sssd[be[test.domain.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55748acb69e0], connected[1], ops[0x55748ac88b10], ldap[0x55748ac9b750]

It looks like instead of checking the group for users, it searches every object to see if it's a member of the group that's allowed to connect.

Yes, but that just means that sssd receives getgrnam or getgrgid for this group. Typically this is done when some application receives the initgroups results which is a list of numerical IDs and then needs to know the group names the user is a member of, so it calls getgrgid in a loop to check the group names. Unfortunately there is no NSS call group_gid_to_name, it's just getgrgrid which resolves the gid and returns all its members.

It's possible to suppress the group member resolution with ignore_group_members.

Thanks for the reply! I still don't understand why when restricting access in sshd_config to certain AD groups forces SSSD to query every user and object in the directory but ignore_group_members is a solution that will work.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4957

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.