Issue

recently attempted to enroll an ipa client using our standard process. this particular client has two ip addresses. received the following error and sssd refuses to start:

Unable to find 'admin' user with 'getent passwd admin@local.domain'!
Unable to reliably detect configuration. Check NSS setup manually.

sssd throws this error:

Exiting the SSSD. Could not restart critical service [nss].

Note: local.domain has been substituted for our actual domain name.

Steps to Reproduce

1. use ipa-client-install command to enroll client in ipa server

ipa-client-install -vv --mkhomedir --no-ntp --principal admin --domain local.domain

Actual behavior

sssd fails with Exiting the SSSD. Could not restart critical service [nss].
log shows args=/usr/bin/getent passwd admin@local.domain
Process finished, return code=2

Expected behavior

ipa client enrolls successfully and sssd starts normally

Version/Release/Distribution

ipa-client-4.6.8-5.0.1.el7_9.9.x86_64

Additional info:

Oracle Linux 7.9 x86_64 client connecting to RHEL 7.9 IdM server. This behavior is abnormal as we have automated our client enrollment process and the vast majority of our clients are Oracle Linux 7.

/var/log/sssd/sssd.log repeats:

(2021-11-09 17:41:55): [sssd] [monitor_restart_service] (0x0010): Process [nss], definitely stopped!
(2021-11-09 17:41:55): [sssd] [monitor_cleanup] (0x0010): Error removing pidfile! (2 [No such file or directory])

I added debugging to nss and two things that stand out in the sssd_nss.log:

(2021-11-10 11:37:37): [nss] [confdb_get_domain_internal] (0x0400): No enumeration for [local.domain]!

(2021-11-10 11:37:37): [nss] [sssd_supplementary_group] (0x0080): Cannot get info on sssd(2021-11-10 11:37:37): [nss] [nss_process_init] (0x0080): Cannot add process to the sssd supplementary group [22]: Invalid argument