maybe bug: group membership disappears after a while

[f1-outsourcing]

After a while the output of this command changes

[@ ]#  getent group userXXX
userXXX:*:6021:apache

to:

[@ ]#  getent group userXXX
userXXX:*:6021:

2nd problem I have is that "id apache" does not show the group at all, but maybe this is because it disappears.

sssd-client-2.9.9-1.el9.x86_64
sssd-common-2.9.9-1.el9.x86_64
sssd-dbus-2.9.9-1.el9.x86_64
sssd-krb5-common-2.9.9-1.el9.x86_64
sssd-ldap-2.9.9-1.el9.x86_64
sssd-tools-2.9.9-1.el9.x86_64

[alexey-tikhonov]

What domain(s)/'id_provider(s)' are configured in /etc/sssd.conf (or snippets) and what database does 'userXXX' and 'apache' belong?

[f1-outsourcing]

I have [domain/default] section with openldap ldap_schema = rfc2307. userXXX comes from limited ldap uid range while 'important' users like 'apache' come from internal /etc/passwd

[alexey-tikhonov]

How do you add local 'apache' user to LDAP 'userXXX' group?

What are the values of 'passwd' and 'group' of your /etc/nsswitch.conf?

[f1-outsourcing]

objectClass: top
objectClass: posixGroup
structuralObjectClass: posixGroup
memberUid: apache

As a work-a-round I am currently running also with nslcd which keeps the group entry, and everything seems to run ok.

passwd:     files sss
#group:      files [SUCCESS=merge] sss 
group:      files [SUCCESS=merge] ldap

ps adding the [SUCCESS=merge] systemd makes get id visibly slower.

[alexey-tikhonov]

2nd problem I have is that "id apache" does not show the group at all

This is expected with your setup: SSSD doesn't know anything about local 'apache' user and thus doesn't return any initgroups.

Other way around - getent group - lists 'apache' (sometimes) by accident: SSSD doesn't resolve 'memberUid' names immediately but rather stores "stubs" in the cache.
But in general I think this - referencing an object SSSD doesn't handle as a member - isn't supported.

@sumit-bose, do you agree?

[sumit-bose]

Hi,

does setting ldap_rfc2307_fallback_to_local_users = true in the [domain/...] section of sssd.conf help? See man sssd-ldap for details.

bye,
Sumit

[f1-outsourcing]

Ok I think I found more. I could not test any more on that host, so I copied the sssd.conf to a different centos9stream host that can go offline a bit.
There I did not encounter this behaviour, there with the same config the apache user stayed. Then I check the /etc/password and there the apache was not configured. So I installed the httpd. But again nothing, I also noticed a difference in installed packages (ad+prox+..) So I removed to have exactly the same, still the apache stayed in the group (constantly stop/start sssd and using sss_cache -E)
So decided to finally give it a restart, now the reboot the apache was missing, but after stop/start sssd and using sss_cache -E 'apache' appeared as member and then finally also there after quite some time >5 min, >10 min it was automatically removed.

does setting ldap_rfc2307_fallback_to_local_users = true in the [domain/...] section of sssd.conf help? See man sssd-ldap for details.

hmmm, yes not to smart to not try that, I was checking sssd.conf. "checking if local users are referenced," maybe check if this is the case for not existing local users, as I seem to be keeping the apache user when it was not installed. But it could also be related to not good testing as this behaviour is only visible after an for me undetermined time >5min >10min?

For now ldap_rfc2307_fallback_to_local_users indeed seems to resolve this issue. Which brings me to my 2nd issue: what is with this id? Why does it not show the group memberships? Is this related to just the id command, how can I be sure if I start httpd it indeed has all groups I configured it for?

[root@hostA sssd]# id userXXX
uid=6021(userXXX) gid=6021(userXXX) groups=6021(userXXX)

[root@hostA sssd]# getent group userXXX
userXXX:*:6021:apache


[root@hostA sssd]# sssctl user-show userXXX
Name: userXXX
Cache entry creation date: 06/23/26 16:46:54
Cache entry last update time: 06/23/26 17:51:21
Cache entry expiration time: Expired
Initgroups expiration time: Expired
Cached in InfoPipe: No

[root@hostA sssd]# getent passwd userXXX
userXXX:*:6021:6021:userXXX:/home/userXXX:/bin/bash

PS. I do not think it is wise to have this delayed removing, nobody is expecting this, if they do a quick test nobody will expect this to be removed. Also if you specifically do not want to trust this from the ldap, it is not nice it is active for short period of time.

[sumit-bose]

Hi,

about the id command, it works for me with ldap_rfc2307_fallback_to_local_users = true as well. I created a group:

dn: cn=myg,ou=Groups,dc=ldap,dc=test
objectClass: top
objectClass: groupOfNames
objectClass: posixGroup
objectClass: nsMemberOf
cn: myg
gidNumber: 1012
memberUid: apache

and on a client I get:

# id apache
uid=48(apache) gid=48(apache) groups=48(apache),1012(myg)

Can you share SSSD logs with debug_level=9 in the [nss] and [domain/...] section to investigate why it fails in your environment?

bye,
Sumit

[f1-outsourcing]

replaced the sssd.conf with the my test config. Restarted sssd and did id apache and then getent group userXXX

[domain/default]
#debug_level=6
ldap_schema = rfc2307
ldap_rfc2307_fallback_to_local_users = true

(2026-06-30 11:46:48): [nss] [server_setup] (0x3f7c0): Starting with debug level = 0x07f0
(2026-06-30 11:46:48): [nss] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb
(2026-06-30 11:46:48): [nss] [confdb_init_domain_provider_and_enum] (0x0400): No enumeration for [default]!
(2026-06-30 11:46:48): [nss] [confdb_init_domain_provider_and_enum] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information
(2026-06-30 11:46:48): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/sh in /etc/shells
(2026-06-30 11:46:48): [nss] [sss_get_etc_shells] (0x0400): Found shell /bin/bash in /etc/shells
(2026-06-30 11:46:48): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/sh in /etc/shells
(2026-06-30 11:46:48): [nss] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/bash in /etc/shells
(2026-06-30 11:46:48): [nss] [sss_names_init_from_args] (0x0100): Using re [^((?P<name>.+)@(?P<domain>[^@]+)|(?P<name>[^@]+))$].
(2026-06-30 11:46:48): [nss] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
(2026-06-30 11:46:48): [nss] [sbus_dbus_connect_address] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/sbus-dp_default bus as sssd.nss
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /*
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /*
(2026-06-30 11:46:48): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameOwnerChanged on path /org/freedesktop/DBus
(2026-06-30 11:46:48): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameAcquired on path /org/freedesktop/DBus
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.Responder.Domain on path /sssd
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.Responder.NegativeCache on path /sssd
(2026-06-30 11:46:48): [nss] [sysdb_domain_init_internal] (0x0200): DB File for default: /var/lib/sss/db/cache_default.ldb
(2026-06-30 11:46:48): [nss] [sysdb_domain_init_internal] (0x0200): Timestamp file for default: /var/lib/sss/db/timestamps_default.ldb
(2026-06-30 11:46:48): [nss] [ldb] (0x0400): asq: Unable to register control with rootdse!
(2026-06-30 11:46:48): [nss] [sss_names_init_from_args] (0x0100): Using re [^(((?P<domain>[^\\]+)[\\(?P<name>.+))|((?P<name>.+)@(?P<domain>[^@]+))|((?P<name>[^@\\]+)))$](file:///%5d+)))$)].
(2026-06-30 11:46:48): [nss] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
(2026-06-30 11:46:48): [nss] [sss_process_init] (0x0400): Responder initialization complete (explicitly configured)
(2026-06-30 11:46:48): [nss] [sss_parse_name] (0x0200): Domain not provided!
(2026-06-30 11:46:48): [nss] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/@root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_parse_name] (0x0200): Domain not provided!
(2026-06-30 11:46:48): [nss] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.nss.MemoryCache on path /sssd
(2026-06-30 11:46:48): [nss] [sss_mmap_cache_init] (0x0100): Fast 'PASSWD' mmap cache: memcache_timeout = 300, slots = 209712
(2026-06-30 11:46:48): [nss] [sss_mmap_cache_init] (0x0100): Fast 'GROUP' mmap cache: memcache_timeout = 300, slots = 157284
(2026-06-30 11:46:48): [nss] [sss_mmap_cache_init] (0x0100): Fast 'INITGROUPS' mmap cache: memcache_timeout = 300, slots = 262140
(2026-06-30 11:46:48): [nss] [sss_mmap_cache_init] (0x0100): Fast 'SID' mmap cache: memcache_timeout = 300, slots = 157284
(2026-06-30 11:46:48): [nss] [responder_set_fd_limit] (0x0100): Maximum file descriptors set to [8192]
(2026-06-30 11:46:48): [nss] [sbus_dbus_connect_address] (0x0400): Connected to unix:path=/var/lib/sss/pipes/private/sbus-monitor bus as sssd.nss
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Introspectable on path /*
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface org.freedesktop.DBus.Properties on path /*
(2026-06-30 11:46:48): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameOwnerChanged on path /org/freedesktop/DBus
(2026-06-30 11:46:48): [nss] [sbus_router_listen] (0x0400): Registering signal listener org.freedesktop.DBus.NameAcquired on path /org/freedesktop/DBus
(2026-06-30 11:46:48): [nss] [sbus_router_add_path] (0x0400): Registering interface sssd.service on path /sssd
(2026-06-30 11:46:48): [nss] [sss_nss_process_init] (0x0400): NSS Initialization complete
(2026-06-30 11:46:48): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: :1.2
(2026-06-30 11:46:48): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
(2026-06-30 11:46:48): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: :1.4
(2026-06-30 11:46:48): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
(2026-06-30 11:46:48): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: sssd.nss
(2026-06-30 11:46:48): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
(2026-06-30 11:46:48): [nss] [sbus_name_acquired] (0x0400): D-Bus name acquired: sssd.nss
(2026-06-30 11:46:48): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameAcquired: Success
(2026-06-30 11:46:48): [nss] [sss_dp_init_done] (0x0400): Client is registered with DP
(2026-06-30 11:46:48): [nss] [cache_req_domain_new_list_from_domain_resolution_order] (0x0400): Domain resolution order list: not set
(2026-06-30 11:46:48): [nss] [sysdb_get_certmap] (0x0400): No certificate maps found.
(2026-06-30 11:46:48): [nss] [sss_parse_name] (0x0200): Domain not provided!
(2026-06-30 11:46:48): [nss] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/@root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_parse_name] (0x0200): Domain not provided!
(2026-06-30 11:46:48): [nss] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_parse_name] (0x0200): Domain not provided!
(2026-06-30 11:46:48): [nss] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/@root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_parse_name] (0x0200): Domain not provided!
(2026-06-30 11:46:48): [nss] [sss_parse_name_for_domains] (0x0200): name 'root' matched without domain, user is root
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GROUP/default/root@default] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/0] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/0] to negative cache permanently
(2026-06-30 11:46:48): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
(2026-06-30 11:46:48): [nss] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success
(2026-06-30 11:46:48): [nss] [sss_monitor_service_init_done] (0x0100): Got id ack and version (1) from Monitor
(2026-06-30 11:50:01): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:50:01): [nss] [accept_fd_handler] (0x0400): [CID#1] Client [cmd /usr/sbin/crond][uid 0][0x558ed0b887c0][22] connected!
(2026-06-30 11:50:01): [nss] [sss_cmd_get_version] (0x0200): [CID#1] Received client version [1].
(2026-06-30 11:50:01): [nss] [sss_cmd_get_version] (0x0200): [CID#1] Offered version [1].
(2026-06-30 11:50:01): [nss] [sss_nss_getby_name] (0x0400): [CID#1] Input name: root
(2026-06-30 11:50:01): [nss] [cache_req_send] (0x0400): [CID#1] CR #0: REQ_TRACE: New request [CID #1] 'Initgroups by name'
(2026-06-30 11:50:01): [nss] [cache_req_process_input] (0x0400): [CID#1] CR #0: Parsing input name [root]
(2026-06-30 11:50:01): [nss] [sss_parse_name] (0x0200): [CID#1] Domain not provided!
(2026-06-30 11:50:01): [nss] [sss_parse_name_for_domains] (0x0200): [CID#1] name 'root' matched without domain, user is root
(2026-06-30 11:50:01): [nss] [sss_nss_get_object_send] (0x0400): [CID#1] Client [0x558ed0b887c0][22]: sent cache request #0
(2026-06-30 11:50:01): [nss] [cache_req_set_name] (0x0400): [CID#1] CR #0: Setting name [root]
(2026-06-30 11:50:01): [nss] [cache_req_select_domains] (0x0400): [CID#1] CR #0: Performing a multi-domain search
(2026-06-30 11:50:01): [nss] [cache_req_search_domains] (0x0400): [CID#1] CR #0: Search will check the cache and check the data provider
(2026-06-30 11:50:01): [nss] [cache_req_set_domain] (0x0400): [CID#1] CR #0: Using domain [default]
(2026-06-30 11:50:01): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#1] CR #0: Preparing input data for domain [default] rules
(2026-06-30 11:50:01): [nss] [cache_req_search_send] (0x0400): [CID#1] CR #0: Looking up root@default
(2026-06-30 11:50:01): [nss] [cache_req_search_ncache] (0x0400): [CID#1] CR #0: Checking negative cache for [root@default]
(2026-06-30 11:50:01): [nss] [cache_req_search_ncache] (0x0400): [CID#1] CR #0: [root@default] does not exist (negative cache)
(2026-06-30 11:50:01): [nss] [cache_req_process_result] (0x0400): [CID#1] CR #0: Finished: Not found
(2026-06-30 11:50:01): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:50:01): [nss] [accept_fd_handler] (0x0400): [CID#2] Client [cmd /usr/sbin/crond][uid 0][0x558ed0b49ab0][23] connected!
(2026-06-30 11:50:01): [nss] [sss_cmd_get_version] (0x0200): [CID#2] Received client version [1].
(2026-06-30 11:50:01): [nss] [sss_cmd_get_version] (0x0200): [CID#2] Offered version [1].
(2026-06-30 11:50:01): [nss] [sss_nss_getby_name] (0x0400): [CID#2] Input name: root
(2026-06-30 11:50:01): [nss] [cache_req_send] (0x0400): [CID#2] CR #1: REQ_TRACE: New request [CID #2] 'Initgroups by name'
(2026-06-30 11:50:01): [nss] [cache_req_process_input] (0x0400): [CID#2] CR #1: Parsing input name [root]
(2026-06-30 11:50:01): [nss] [sss_parse_name] (0x0200): [CID#2] Domain not provided!
(2026-06-30 11:50:01): [nss] [sss_parse_name_for_domains] (0x0200): [CID#2] name 'root' matched without domain, user is root
(2026-06-30 11:50:01): [nss] [sss_nss_get_object_send] (0x0400): [CID#2] Client [0x558ed0b49ab0][23]: sent cache request #1
(2026-06-30 11:50:01): [nss] [cache_req_set_name] (0x0400): [CID#2] CR #1: Setting name [root]
(2026-06-30 11:50:01): [nss] [cache_req_select_domains] (0x0400): [CID#2] CR #1: Performing a multi-domain search
(2026-06-30 11:50:01): [nss] [cache_req_search_domains] (0x0400): [CID#2] CR #1: Search will check the cache and check the data provider
(2026-06-30 11:50:01): [nss] [cache_req_set_domain] (0x0400): [CID#2] CR #1: Using domain [default]
(2026-06-30 11:50:01): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#2] CR #1: Preparing input data for domain [default] rules
(2026-06-30 11:50:01): [nss] [cache_req_search_send] (0x0400): [CID#2] CR #1: Looking up root@default
(2026-06-30 11:50:01): [nss] [cache_req_search_ncache] (0x0400): [CID#2] CR #1: Checking negative cache for [root@default]
(2026-06-30 11:50:01): [nss] [cache_req_search_ncache] (0x0400): [CID#2] CR #1: [root@default] does not exist (negative cache)
(2026-06-30 11:50:01): [nss] [cache_req_process_result] (0x0400): [CID#2] CR #1: Finished: Not found
(2026-06-30 11:50:01): [nss] [client_recv] (0x0200): [CID#1] Client disconnected!
(2026-06-30 11:50:01): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:50:01): [nss] [accept_fd_handler] (0x0400): [CID#3] Client [cmd /usr/sbin/crond][uid 0][0x558ed0b887c0][22] connected!
(2026-06-30 11:50:01): [nss] [sss_cmd_get_version] (0x0200): [CID#3] Received client version [1].
(2026-06-30 11:50:01): [nss] [sss_cmd_get_version] (0x0200): [CID#3] Offered version [1].
(2026-06-30 11:50:01): [nss] [sss_nss_getby_name] (0x0400): [CID#3] Input name: root
(2026-06-30 11:50:01): [nss] [cache_req_send] (0x0400): [CID#3] CR #2: REQ_TRACE: New request [CID #3] 'Initgroups by name'
(2026-06-30 11:50:01): [nss] [cache_req_process_input] (0x0400): [CID#3] CR #2: Parsing input name [root]
(2026-06-30 11:50:01): [nss] [sss_parse_name] (0x0200): [CID#3] Domain not provided!
(2026-06-30 11:50:01): [nss] [sss_parse_name_for_domains] (0x0200): [CID#3] name 'root' matched without domain, user is root
(2026-06-30 11:50:01): [nss] [sss_nss_get_object_send] (0x0400): [CID#3] Client [0x558ed0b887c0][22]: sent cache request #2
(2026-06-30 11:50:01): [nss] [cache_req_set_name] (0x0400): [CID#3] CR #2: Setting name [root]
(2026-06-30 11:50:01): [nss] [cache_req_select_domains] (0x0400): [CID#3] CR #2: Performing a multi-domain search
(2026-06-30 11:50:01): [nss] [cache_req_search_domains] (0x0400): [CID#3] CR #2: Search will check the cache and check the data provider
(2026-06-30 11:50:01): [nss] [cache_req_set_domain] (0x0400): [CID#3] CR #2: Using domain [default]
(2026-06-30 11:50:01): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#3] CR #2: Preparing input data for domain [default] rules
(2026-06-30 11:50:01): [nss] [cache_req_search_send] (0x0400): [CID#3] CR #2: Looking up root@default
(2026-06-30 11:50:01): [nss] [cache_req_search_ncache] (0x0400): [CID#3] CR #2: Checking negative cache for [root@default]
(2026-06-30 11:50:01): [nss] [cache_req_search_ncache] (0x0400): [CID#3] CR #2: [root@default] does not exist (negative cache)
(2026-06-30 11:50:01): [nss] [cache_req_process_result] (0x0400): [CID#3] CR #2: Finished: Not found
(2026-06-30 11:50:01): [nss] [client_recv] (0x0200): [CID#3] Client disconnected!
(2026-06-30 11:50:01): [nss] [client_recv] (0x0200): [CID#2] Client disconnected!
(2026-06-30 11:55:01): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:55:01): [nss] [accept_fd_handler] (0x0400): [CID#4] Client [cmd /usr/sbin/crond][uid 0][0x558ed0b49ab0][22] connected!
(2026-06-30 11:55:01): [nss] [sss_cmd_get_version] (0x0200): [CID#4] Received client version [1].
(2026-06-30 11:55:01): [nss] [sss_cmd_get_version] (0x0200): [CID#4] Offered version [1].
(2026-06-30 11:55:01): [nss] [sss_nss_getby_name] (0x0400): [CID#4] Input name: root
(2026-06-30 11:55:01): [nss] [cache_req_send] (0x0400): [CID#4] CR #3: REQ_TRACE: New request [CID #4] 'Initgroups by name'
(2026-06-30 11:55:01): [nss] [cache_req_process_input] (0x0400): [CID#4] CR #3: Parsing input name [root]
(2026-06-30 11:55:01): [nss] [sss_parse_name] (0x0200): [CID#4] Domain not provided!
(2026-06-30 11:55:01): [nss] [sss_parse_name_for_domains] (0x0200): [CID#4] name 'root' matched without domain, user is root
(2026-06-30 11:55:01): [nss] [sss_nss_get_object_send] (0x0400): [CID#4] Client [0x558ed0b49ab0][22]: sent cache request #3
(2026-06-30 11:55:01): [nss] [cache_req_set_name] (0x0400): [CID#4] CR #3: Setting name [root]
(2026-06-30 11:55:01): [nss] [cache_req_select_domains] (0x0400): [CID#4] CR #3: Performing a multi-domain search
(2026-06-30 11:55:01): [nss] [cache_req_search_domains] (0x0400): [CID#4] CR #3: Search will check the cache and check the data provider
(2026-06-30 11:55:01): [nss] [cache_req_set_domain] (0x0400): [CID#4] CR #3: Using domain [default]
(2026-06-30 11:55:01): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#4] CR #3: Preparing input data for domain [default] rules
(2026-06-30 11:55:01): [nss] [cache_req_search_send] (0x0400): [CID#4] CR #3: Looking up root@default
(2026-06-30 11:55:01): [nss] [cache_req_search_ncache] (0x0400): [CID#4] CR #3: Checking negative cache for [root@default]
(2026-06-30 11:55:01): [nss] [cache_req_search_ncache] (0x0400): [CID#4] CR #3: [root@default] does not exist (negative cache)
(2026-06-30 11:55:01): [nss] [cache_req_process_result] (0x0400): [CID#4] CR #3: Finished: Not found
(2026-06-30 11:55:01): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:55:01): [nss] [accept_fd_handler] (0x0400): [CID#5] Client [cmd /usr/sbin/crond][uid 0][0x558ed0b887c0][23] connected!
(2026-06-30 11:55:01): [nss] [sss_cmd_get_version] (0x0200): [CID#5] Received client version [1].
(2026-06-30 11:55:01): [nss] [sss_cmd_get_version] (0x0200): [CID#5] Offered version [1].
(2026-06-30 11:55:01): [nss] [sss_nss_getby_name] (0x0400): [CID#5] Input name: root
(2026-06-30 11:55:01): [nss] [cache_req_send] (0x0400): [CID#5] CR #4: REQ_TRACE: New request [CID #5] 'Initgroups by name'
(2026-06-30 11:55:01): [nss] [cache_req_process_input] (0x0400): [CID#5] CR #4: Parsing input name [root]
(2026-06-30 11:55:01): [nss] [sss_parse_name] (0x0200): [CID#5] Domain not provided!
(2026-06-30 11:55:01): [nss] [sss_parse_name_for_domains] (0x0200): [CID#5] name 'root' matched without domain, user is root
(2026-06-30 11:55:01): [nss] [sss_nss_get_object_send] (0x0400): [CID#5] Client [0x558ed0b887c0][23]: sent cache request #4
(2026-06-30 11:55:01): [nss] [cache_req_set_name] (0x0400): [CID#5] CR #4: Setting name [root]
(2026-06-30 11:55:01): [nss] [cache_req_select_domains] (0x0400): [CID#5] CR #4: Performing a multi-domain search
(2026-06-30 11:55:01): [nss] [cache_req_search_domains] (0x0400): [CID#5] CR #4: Search will check the cache and check the data provider
(2026-06-30 11:55:01): [nss] [cache_req_set_domain] (0x0400): [CID#5] CR #4: Using domain [default]
(2026-06-30 11:55:01): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#5] CR #4: Preparing input data for domain [default] rules
(2026-06-30 11:55:01): [nss] [cache_req_search_send] (0x0400): [CID#5] CR #4: Looking up root@default
(2026-06-30 11:55:01): [nss] [cache_req_search_ncache] (0x0400): [CID#5] CR #4: Checking negative cache for [root@default]
(2026-06-30 11:55:01): [nss] [cache_req_search_ncache] (0x0400): [CID#5] CR #4: [root@default] does not exist (negative cache)
(2026-06-30 11:55:01): [nss] [cache_req_process_result] (0x0400): [CID#5] CR #4: Finished: Not found
(2026-06-30 11:55:01): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:55:01): [nss] [accept_fd_handler] (0x0400): [CID#6] Client [cmd /usr/sbin/crond][uid 0][0x558ed0b8d090][24] connected!
(2026-06-30 11:55:01): [nss] [sss_cmd_get_version] (0x0200): [CID#6] Received client version [1].
(2026-06-30 11:55:01): [nss] [sss_cmd_get_version] (0x0200): [CID#6] Offered version [1].
(2026-06-30 11:55:01): [nss] [sss_nss_getby_name] (0x0400): [CID#6] Input name: root
(2026-06-30 11:55:01): [nss] [cache_req_send] (0x0400): [CID#6] CR #5: REQ_TRACE: New request [CID #6] 'Initgroups by name'
(2026-06-30 11:55:01): [nss] [cache_req_process_input] (0x0400): [CID#6] CR #5: Parsing input name [root]
(2026-06-30 11:55:01): [nss] [sss_parse_name] (0x0200): [CID#6] Domain not provided!
(2026-06-30 11:55:01): [nss] [sss_parse_name_for_domains] (0x0200): [CID#6] name 'root' matched without domain, user is root
(2026-06-30 11:55:01): [nss] [sss_nss_get_object_send] (0x0400): [CID#6] Client [0x558ed0b8d090][24]: sent cache request #5
(2026-06-30 11:55:01): [nss] [cache_req_set_name] (0x0400): [CID#6] CR #5: Setting name [root]
(2026-06-30 11:55:01): [nss] [cache_req_select_domains] (0x0400): [CID#6] CR #5: Performing a multi-domain search
(2026-06-30 11:55:01): [nss] [cache_req_search_domains] (0x0400): [CID#6] CR #5: Search will check the cache and check the data provider
(2026-06-30 11:55:01): [nss] [cache_req_set_domain] (0x0400): [CID#6] CR #5: Using domain [default]
(2026-06-30 11:55:01): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#6] CR #5: Preparing input data for domain [default] rules
(2026-06-30 11:55:01): [nss] [cache_req_search_send] (0x0400): [CID#6] CR #5: Looking up root@default
(2026-06-30 11:55:01): [nss] [cache_req_search_ncache] (0x0400): [CID#6] CR #5: Checking negative cache for [root@default]
(2026-06-30 11:55:01): [nss] [cache_req_search_ncache] (0x0400): [CID#6] CR #5: [root@default] does not exist (negative cache)
(2026-06-30 11:55:01): [nss] [cache_req_process_result] (0x0400): [CID#6] CR #5: Finished: Not found
(2026-06-30 11:55:01): [nss] [client_recv] (0x0200): [CID#6] Client disconnected!
(2026-06-30 11:55:02): [nss] [client_recv] (0x0200): [CID#5] Client disconnected!
(2026-06-30 11:55:02): [nss] [client_recv] (0x0200): [CID#4] Client disconnected!
(2026-06-30 11:55:43): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:55:43): [nss] [accept_fd_handler] (0x0400): [CID#7] Client [cmd ls][uid 0][0x558ed0b49ab0][22] connected!
(2026-06-30 11:55:43): [nss] [sss_cmd_get_version] (0x0200): [CID#7] Received client version [1].
(2026-06-30 11:55:43): [nss] [sss_cmd_get_version] (0x0200): [CID#7] Offered version [1].
(2026-06-30 11:55:43): [nss] [sss_nss_getby_id] (0x0400): [CID#7] Input ID: 992 (looking up 'POSIX data')
(2026-06-30 11:55:43): [nss] [cache_req_send] (0x0400): [CID#7] CR #6: REQ_TRACE: New request [CID #7] 'Group by ID'
(2026-06-30 11:55:43): [nss] [cache_req_select_domains] (0x0400): [CID#7] CR #6: Performing a multi-domain search
(2026-06-30 11:55:43): [nss] [cache_req_search_domains] (0x0400): [CID#7] CR #6: Search will check the cache and check the data provider
(2026-06-30 11:55:43): [nss] [cache_req_set_domain] (0x0400): [CID#7] CR #6: Using domain [default]
(2026-06-30 11:55:43): [nss] [cache_req_search_send] (0x0400): [CID#7] CR #6: Looking up gid:992@default
(2026-06-30 11:55:43): [nss] [cache_req_search_ncache] (0x0400): [CID#7] CR #6: Checking negative cache for [gid:992@default]
(2026-06-30 11:55:43): [nss] [cache_req_search_ncache] (0x0400): [CID#7] CR #6: [GID:992@default] is not present in negative cache
(2026-06-30 11:55:43): [nss] [cache_req_search_cache] (0x0400): [CID#7] CR #6: Looking up [gid:992@default] in cache
(2026-06-30 11:55:43): [nss] [cache_req_idminmax_check] (0x0200): [CID#7] id exceeds min/max boundaries
(2026-06-30 11:55:43): [nss] [cache_req_search_cache] (0x0400): [CID#7] CR #6: ID [gid:992@default] was filtered out
(2026-06-30 11:55:43): [nss] [sss_nss_get_object_send] (0x0400): [CID#7] Client [0x558ed0b49ab0][22]: sent cache request #6
(2026-06-30 11:55:43): [nss] [cache_req_process_result] (0x0400): [CID#7] CR #6: Finished: Not found
(2026-06-30 11:55:43): [nss] [sss_nss_getby_id] (0x0400): [CID#7] Input ID: 0 (looking up 'POSIX data')
(2026-06-30 11:55:43): [nss] [cache_req_send] (0x0400): [CID#7] CR #7: REQ_TRACE: New request [CID #7] 'Group by ID'
(2026-06-30 11:55:43): [nss] [cache_req_select_domains] (0x0400): [CID#7] CR #7: Performing a multi-domain search
(2026-06-30 11:55:43): [nss] [cache_req_search_domains] (0x0400): [CID#7] CR #7: Search will check the cache and check the data provider
(2026-06-30 11:55:43): [nss] [cache_req_set_domain] (0x0400): [CID#7] CR #7: Using domain [default]
(2026-06-30 11:55:43): [nss] [cache_req_search_send] (0x0400): [CID#7] CR #7: Looking up GID:0@default
(2026-06-30 11:55:43): [nss] [cache_req_search_ncache] (0x0400): [CID#7] CR #7: Checking negative cache for [gid:0@default]
(2026-06-30 11:55:43): [nss] [cache_req_search_ncache] (0x0400): [CID#7] CR #7: [gid:0@default] does not exist (negative cache)
(2026-06-30 11:55:43): [nss] [sss_nss_get_object_send] (0x0400): [CID#7] Client [0x558ed0b49ab0][22]: sent cache request #7
(2026-06-30 11:55:43): [nss] [cache_req_process_result] (0x0400): [CID#7] CR #7: Finished: Not found
(2026-06-30 11:55:43): [nss] [client_recv] (0x0200): [CID#7] Client disconnected!
(2026-06-30 11:56:08): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:56:08): [nss] [accept_fd_handler] (0x0400): [CID#8] Client [cmd id][uid 0][0x558ed0b49ab0][22] connected!
(2026-06-30 11:56:08): [nss] [sss_cmd_get_version] (0x0200): [CID#8] Received client version [1].
(2026-06-30 11:56:08): [nss] [sss_cmd_get_version] (0x0200): [CID#8] Offered version [1].
(2026-06-30 11:56:08): [nss] [sss_nss_getby_id] (0x0400): [CID#8] Input ID: 48 (looking up 'POSIX data')
(2026-06-30 11:56:08): [nss] [cache_req_send] (0x0400): [CID#8] CR #8: REQ_TRACE: New request [CID #8] 'Group by ID'
(2026-06-30 11:56:08): [nss] [cache_req_select_domains] (0x0400): [CID#8] CR #8: Performing a multi-domain search
(2026-06-30 11:56:08): [nss] [cache_req_search_domains] (0x0400): [CID#8] CR #8: Search will check the cache and check the data provider
(2026-06-30 11:56:08): [nss] [cache_req_set_domain] (0x0400): [CID#8] CR #8: Using domain [default]
(2026-06-30 11:56:08): [nss] [cache_req_search_send] (0x0400): [CID#8] CR #8: Looking up GID:48@default
(2026-06-30 11:56:08): [nss] [cache_req_search_ncache] (0x0400): [CID#8] CR #8: Checking negative cache for [gid:48@default]
(2026-06-30 11:56:08): [nss] [cache_req_search_ncache] (0x0400): [CID#8] CR #8: [gid:48@default] is not present in negative cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #8: Looking up [gid:48@default] in cache
(2026-06-30 11:56:08): [nss] [cache_req_idminmax_check] (0x0200): [CID#8] id exceeds min/max boundaries
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #8: ID [gid:48@default] was filtered out
(2026-06-30 11:56:08): [nss] [sss_nss_get_object_send] (0x0400): [CID#8] Client [0x558ed0b49ab0][22]: sent cache request #8
(2026-06-30 11:56:08): [nss] [cache_req_process_result] (0x0400): [CID#8] CR #8: Finished: Not found
(2026-06-30 11:56:08): [nss] [sss_nss_getby_name] (0x0400): [CID#8] Input name: apache
(2026-06-30 11:56:08): [nss] [cache_req_send] (0x0400): [CID#8] CR #9: REQ_TRACE: New request [CID #8] 'Initgroups by name'
(2026-06-30 11:56:08): [nss] [cache_req_process_input] (0x0400): [CID#8] CR #9: Parsing input name [apache]
(2026-06-30 11:56:08): [nss] [sss_parse_name] (0x0200): [CID#8] Domain not provided!
(2026-06-30 11:56:08): [nss] [sss_parse_name_for_domains] (0x0200): [CID#8] name 'apache' matched without domain, user is apache
(2026-06-30 11:56:08): [nss] [sss_nss_get_object_send] (0x0400): [CID#8] Client [0x558ed0b49ab0][22]: sent cache request #9
(2026-06-30 11:56:08): [nss] [cache_req_set_name] (0x0400): [CID#8] CR #9: Setting name [apache]
(2026-06-30 11:56:08): [nss] [cache_req_select_domains] (0x0400): [CID#8] CR #9: Performing a multi-domain search
(2026-06-30 11:56:08): [nss] [cache_req_search_domains] (0x0400): [CID#8] CR #9: Search will check the cache and check the data provider
(2026-06-30 11:56:08): [nss] [cache_req_set_domain] (0x0400): [CID#8] CR #9: Using domain [default]
(2026-06-30 11:56:08): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#8] CR #9: Preparing input data for domain [default] rules
(2026-06-30 11:56:08): [nss] [cache_req_search_send] (0x0400): [CID#8] CR #9: Looking up apache@default
(2026-06-30 11:56:08): [nss] [cache_req_search_ncache] (0x0400): [CID#8] CR #9: Checking negative cache for [apache@default]
(2026-06-30 11:56:08): [nss] [cache_req_search_ncache] (0x0400): [CID#8] CR #9: [apache@default] is not present in negative cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Looking up [apache@default] in cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Object [apache@default] was not found in cache
(2026-06-30 11:56:08): [nss] [cache_req_search_dp] (0x0400): [CID#8] CR #9: Looking up [apache@default] in data provider
(2026-06-30 11:56:08): [nss] [sss_dp_get_account_send] (0x0400): [CID#8] Creating request for [default][0x3][BE_REQ_INITGROUPS][name=apache@default:-]
(2026-06-30 11:56:08): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#8] CR #9: Data Provider Error: 3, 22, Init group lookup failed
(2026-06-30 11:56:08): [nss] [cache_req_common_process_dp_reply] (0x0400): [CID#8] CR #9: Due to an error we will return cached data
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Looking up [apache@default] in cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Object [apache@default] was not found in cache
(2026-06-30 11:56:08): [nss] [cache_req_process_result] (0x0400): [CID#8] CR #9: Finished: Not found
(2026-06-30 11:56:08): [nss] [sss_nss_getby_id] (0x0400): [CID#8] Input ID: 48 (looking up 'POSIX data')
(2026-06-30 11:56:08): [nss] [cache_req_send] (0x0400): [CID#8] CR #10: REQ_TRACE: New request [CID #8] 'Group by ID'
(2026-06-30 11:56:08): [nss] [cache_req_select_domains] (0x0400): [CID#8] CR #10: Performing a multi-domain search
(2026-06-30 11:56:08): [nss] [cache_req_search_domains] (0x0400): [CID#8] CR #10: Search will check the cache and check the data provider
(2026-06-30 11:56:08): [nss] [cache_req_set_domain] (0x0400): [CID#8] CR #10: Using domain [default]
(2026-06-30 11:56:08): [nss] [cache_req_search_send] (0x0400): [CID#8] CR #10: Looking up GID:48@default
(2026-06-30 11:56:08): [nss] [cache_req_search_ncache] (0x0400): [CID#8] CR #10: Checking negative cache for [gid:48@default]
(2026-06-30 11:56:08): [nss] [cache_req_search_ncache] (0x0400): [CID#8] CR #10: [gid:48@default] is not present in negative cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #10: Looking up [gid:48@default] in cache
(2026-06-30 11:56:08): [nss] [cache_req_idminmax_check] (0x0200): [CID#8] id exceeds min/max boundaries
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #10: ID [gid:48@default] was filtered out
(2026-06-30 11:56:08): [nss] [sss_nss_get_object_send] (0x0400): [CID#8] Client [0x558ed0b49ab0][22]: sent cache request #10
(2026-06-30 11:56:08): [nss] [cache_req_process_result] (0x0400): [CID#8] CR #10: Finished: Not found
(2026-06-30 11:56:08): [nss] [client_recv] (0x0200): [CID#8] Client disconnected!
(2026-06-30 11:56:30): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:56:30): [nss] [accept_fd_handler] (0x0400): [CID#9] Client [cmd getent][uid 0][0x558ed0b49ab0][22] connected!
(2026-06-30 11:56:30): [nss] [sss_cmd_get_version] (0x0200): [CID#9] Received client version [1].
(2026-06-30 11:56:30): [nss] [sss_cmd_get_version] (0x0200): [CID#9] Offered version [1].
(2026-06-30 11:56:30): [nss] [sss_nss_getby_name] (0x0400): [CID#9] Input name: userXXX
(2026-06-30 11:56:30): [nss] [cache_req_send] (0x0400): [CID#9] CR #11: REQ_TRACE: New request [CID #9] 'Group by name'
(2026-06-30 11:56:30): [nss] [cache_req_process_input] (0x0400): [CID#9] CR #11: Parsing input name [userXXX]
(2026-06-30 11:56:30): [nss] [sss_parse_name] (0x0200): [CID#9] Domain not provided!
(2026-06-30 11:56:30): [nss] [sss_parse_name_for_domains] (0x0200): [CID#9] name 'userXXX' matched without domain, user is userXXX
(2026-06-30 11:56:30): [nss] [sss_nss_get_object_send] (0x0400): [CID#9] Client [0x558ed0b49ab0][22]: sent cache request #11
(2026-06-30 11:56:30): [nss] [cache_req_set_name] (0x0400): [CID#9] CR #11: Setting name [userXXX]
(2026-06-30 11:56:30): [nss] [cache_req_select_domains] (0x0400): [CID#9] CR #11: Performing a multi-domain search
(2026-06-30 11:56:30): [nss] [cache_req_search_domains] (0x0400): [CID#9] CR #11: Search will check the cache and check the data provider
(2026-06-30 11:56:30): [nss] [cache_req_set_domain] (0x0400): [CID#9] CR #11: Using domain [default]
(2026-06-30 11:56:30): [nss] [cache_req_prepare_domain_data] (0x0400): [CID#9] CR #11: Preparing input data for domain [default] rules
(2026-06-30 11:56:30): [nss] [cache_req_search_send] (0x0400): [CID#9] CR #11: Looking up userXXX@default
(2026-06-30 11:56:30): [nss] [cache_req_search_ncache] (0x0400): [CID#9] CR #11: Checking negative cache for [userXXX@default]
(2026-06-30 11:56:30): [nss] [cache_req_search_ncache] (0x0400): [CID#9] CR #11: [userXXX@default] is not present in negative cache
(2026-06-30 11:56:30): [nss] [cache_req_search_cache] (0x0400): [CID#9] CR #11: Looking up [userXXX@default] in cache
(2026-06-30 11:56:30): [nss] [cache_req_search_send] (0x0400): [CID#9] CR #11: Object found, but needs to be refreshed.
(2026-06-30 11:56:30): [nss] [cache_req_search_dp] (0x0400): [CID#9] CR #11: Looking up [userXXX@default] in data provider
(2026-06-30 11:56:30): [nss] [sss_dp_get_account_send] (0x0400): [CID#9] Creating request for [default][0x2][BE_REQ_GROUP][name=userXXX@default:-]
(2026-06-30 11:56:31): [nss] [cache_req_search_cache] (0x0400): [CID#9] CR #11: Looking up [userXXX@default] in cache
(2026-06-30 11:56:31): [nss] [cache_req_search_ncache_filter] (0x0400): [CID#9] CR #11: This request type does not support filtering result by negative cache
(2026-06-30 11:56:31): [nss] [cache_req_search_done] (0x0400): [CID#9] CR #11: Returning updated object [userXXX@default]
(2026-06-30 11:56:31): [nss] [cache_req_create_and_add_result] (0x0400): [CID#9] CR #11: Found 1 entries in domain default
(2026-06-30 11:56:31): [nss] [cache_req_done] (0x0400): [CID#9] CR #11: Finished: Success
(2026-06-30 11:56:31): [nss] [client_recv] (0x0200): [CID#9] Client disconnected!
(2026-06-30 11:56:39): [nss] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(2026-06-30 11:56:39): [nss] [accept_fd_handler] (0x0400): [CID#10] Client [cmd ls][uid 0][0x558ed0b49ab0][22] connected!
(2026-06-30 11:56:39): [nss] [sss_cmd_get_version] (0x0200): [CID#10] Received client version [1].
(2026-06-30 11:56:39): [nss] [sss_cmd_get_version] (0x0200): [CID#10] Offered version [1].
(2026-06-30 11:56:39): [nss] [sss_nss_getby_id] (0x0400): [CID#10] Input ID: 992 (looking up 'POSIX data')
(2026-06-30 11:56:39): [nss] [cache_req_send] (0x0400): [CID#10] CR #12: REQ_TRACE: New request [CID #10] 'Group by ID'
(2026-06-30 11:56:39): [nss] [cache_req_select_domains] (0x0400): [CID#10] CR #12: Performing a multi-domain search
(2026-06-30 11:56:39): [nss] [cache_req_search_domains] (0x0400): [CID#10] CR #12: Search will check the cache and check the data provider
(2026-06-30 11:56:39): [nss] [cache_req_set_domain] (0x0400): [CID#10] CR #12: Using domain [default]
(2026-06-30 11:56:39): [nss] [cache_req_search_send] (0x0400): [CID#10] CR #12: Looking up GID:992@default
(2026-06-30 11:56:39): [nss] [cache_req_search_ncache] (0x0400): [CID#10] CR #12: Checking negative cache for [gid:992@default]
(2026-06-30 11:56:39): [nss] [cache_req_search_ncache] (0x0400): [CID#10] CR #12: [gid:992@default] is not present in negative cache
(2026-06-30 11:56:39): [nss] [cache_req_search_cache] (0x0400): [CID#10] CR #12: Looking up [gid:992@default] in cache
(2026-06-30 11:56:39): [nss] [cache_req_idminmax_check] (0x0200): [CID#10] id exceeds min/max boundaries
(2026-06-30 11:56:39): [nss] [cache_req_search_cache] (0x0400): [CID#10] CR #12: ID [gid:992@default] was filtered out
(2026-06-30 11:56:39): [nss] [sss_nss_get_object_send] (0x0400): [CID#10] Client [0x558ed0b49ab0][22]: sent cache request #12
(2026-06-30 11:56:39): [nss] [cache_req_process_result] (0x0400): [CID#10] CR #12: Finished: Not found
(2026-06-30 11:56:39): [nss] [sss_nss_getby_id] (0x0400): [CID#10] Input ID: 0 (looking up 'POSIX data')
(2026-06-30 11:56:39): [nss] [cache_req_send] (0x0400): [CID#10] CR #13: REQ_TRACE: New request [CID #10] 'Group by ID'
(2026-06-30 11:56:39): [nss] [cache_req_select_domains] (0x0400): [CID#10] CR #13: Performing a multi-domain search
(2026-06-30 11:56:39): [nss] [cache_req_search_domains] (0x0400): [CID#10] CR #13: Search will check the cache and check the data provider
(2026-06-30 11:56:39): [nss] [cache_req_set_domain] (0x0400): [CID#10] CR #13: Using domain [default]
(2026-06-30 11:56:39): [nss] [cache_req_search_send] (0x0400): [CID#10] CR #13: Looking up GID:0@default
(2026-06-30 11:56:39): [nss] [cache_req_search_ncache] (0x0400): [CID#10] CR #13: Checking negative cache for [gid:0@default]
(2026-06-30 11:56:39): [nss] [cache_req_search_ncache] (0x0400): [CID#10] CR #13: [gid:0@default] does not exist (negative cache)
(2026-06-30 11:56:39): [nss] [sss_nss_get_object_send] (0x0400): [CID#10] Client [0x558ed0b49ab0][22]: sent cache request #13
(2026-06-30 11:56:39): [nss] [cache_req_process_result] (0x0400): [CID#10] CR #13: Finished: Not found
(2026-06-30 11:56:39): [nss] [client_recv] (0x0200): [CID#10] Client disconnected!

[sumit-bose]

Hi,

thank you for the log. The important part is:

(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Looking up [apache@default] in cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Object [apache@default] was not found in cache
(2026-06-30 11:56:08): [nss] [cache_req_search_dp] (0x0400): [CID#8] CR #9: Looking up [apache@default] in data provider
(2026-06-30 11:56:08): [nss] [sss_dp_get_account_send] (0x0400): [CID#8] Creating request for [default][0x3][BE_REQ_INITGROUPS][name=apache@default:-]
(2026-06-30 11:56:08): [nss] [cache_req_common_process_dp_reply] (0x3f7c0): [CID#8] CR #9: Data Provider Error: 3, 22, Init group lookup failed
(2026-06-30 11:56:08): [nss] [cache_req_common_process_dp_reply] (0x0400): [CID#8] CR #9: Due to an error we will return cached data
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Looking up [apache@default] in cache
(2026-06-30 11:56:08): [nss] [cache_req_search_cache] (0x0400): [CID#8] CR #9: Object [apache@default] was not found in cache
(2026-06-30 11:56:08): [nss] [cache_req_process_result] (0x0400): [CID#8] CR #9: Finished: Not found

The backend returns and error while looking up the group-membership information about the apache user. Can you send the backend log, in you case it should be sssd_default.log, as well.

bye,
Sumit

[f1-outsourcing]

Sorry forgot about this. Yes the ldap backend does not have an apache user, that is local.
put back the testing sssd.conf

service sssd start
sss_cache --everything

echo > sssd.log
echo > sssd_pam.log
echo > sssd_default.log
echo > sssd_nss.log

getent group userXXX
id apache

sssd_default.log

(2026-07-16 12:58:02): [be[default]] [dp_get_account_info_send] (0x0200): Got request for [0x2][BE_REQ_GROUP][name=userXXX@default]
(2026-07-16 12:58:02): [be[default]] [dp_attach_req] (0x0400): [RID#9] DP Request [Account #9]: REQ_TRACE: New request. [sssd.nss CID #25] Flags [0x0001].
(2026-07-16 12:58:02): [be[default]] [dp_attach_req] (0x0400): [RID#9] Number of active DP request: 1
(2026-07-16 12:58:02): [be[default]] [sdap_get_groups_next_base] (0x0400): [RID#9] Searching for groups with base [ou=xxxxxxxxxxxxxxxxx]
(2026-07-16 12:58:02): [be[default]] [sdap_get_generic_ext_step] (0x0400): [RID#9] ldap_search_ext called: server: [192.168.10.17:8443] filter: [(&(cn=userXXX)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))] base: [ou=xxxxxxxxxxxxx]; msgid = 10
(2026-07-16 12:58:02): [be[default]] [sdap_get_generic_op_finished] (0x0400): [RID#9] Search result: Success(0), no errmsg set
(2026-07-16 12:58:02): [be[default]] [sdap_get_groups_process] (0x0400): [RID#9] Search for groups, returned 1 results.
(2026-07-16 12:58:02): [be[default]] [sysdb_search_by_name] (0x0400): [RID#9] No such entry
(2026-07-16 12:58:02): [be[default]] [sdap_process_missing_member_2307] (0x0400): [RID#9] Adding a ghost entry
(2026-07-16 12:58:02): [be[default]] [sdap_get_primary_name] (0x0400): [RID#9] Processing object userXXX
(2026-07-16 12:58:02): [be[default]] [sdap_save_group] (0x0400): [RID#9] Processing group userXXX@default
(2026-07-16 12:58:02): [be[default]] [sdap_process_ghost_members] (0x0400): [RID#9] Group has 1 members
(2026-07-16 12:58:02): [be[default]] [sdap_save_group] (0x0400): [RID#9] Storing info for group userXXX@default
(2026-07-16 12:58:02): [be[default]] [sysdb_set_entry_attr] (0x0200): [RID#9] Entry [name=userXXX@default,cn=groups,cn=default,cn=sysdb] has set [ts_cache] attrs.
(2026-07-16 12:58:02): [be[default]] [sysdb_store_group] (0x0400): [RID#9] Group "userXXX@default" has been stored
(2026-07-16 12:58:02): [be[default]] [dp_req_done] (0x0400): [RID#9] DP Request [Account #9]: Request handler finished [0]: Success
(2026-07-16 12:58:02): [be[default]] [_dp_req_recv] (0x0400): [RID#9] DP Request [Account #9]: Receiving request data.
(2026-07-16 12:58:02): [be[default]] [dp_req_destructor] (0x0400): [RID#9] DP Request [Account #9]: Request removed.
(2026-07-16 12:58:02): [be[default]] [dp_req_destructor] (0x0400): [RID#9] Number of active DP request: 0
(2026-07-16 12:58:02): [be[default]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success
(2026-07-16 12:58:43): [be[default]] [dp_get_account_info_send] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=apache@default]
(2026-07-16 12:58:43): [be[default]] [dp_attach_req] (0x0400): [RID#10] DP Request [Initgroups #10]: REQ_TRACE: New request. [sssd.nss CID #28] Flags [0x0001].
(2026-07-16 12:58:43): [be[default]] [dp_attach_req] (0x0400): [RID#10] Number of active DP request: 1
(2026-07-16 12:58:43): [be[default]] [sdap_get_initgr_next_base] (0x0400): [RID#10] Searching for users with base [ou=xxxxxxxxxxxxxxxxx]
(2026-07-16 12:58:43): [be[default]] [sdap_get_generic_ext_step] (0x0400): [RID#10] ldap_search_ext called: server: [192.168.10.17:8443] filter: [(&(uid=apache)(objectclass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))] base: [ou=xxxxxxxxxxxx]; msgid = 11
(2026-07-16 12:58:43): [be[default]] [sdap_get_generic_op_finished] (0x0400): [RID#10] Search result: Success(0), no errmsg set
(2026-07-16 12:58:43): [be[default]] [sdap_save_user] (0x0400): [RID#10] Save user
(2026-07-16 12:58:43): [be[default]] [sdap_get_primary_name] (0x0400): [RID#10] Processing object apache
(2026-07-16 12:58:43): [be[default]] [sdap_save_user] (0x0400): [RID#10] Processing user apache@default
(2026-07-16 12:58:43): [be[default]] [sdap_save_user] (0x0040): [RID#10] User [apache@default] filtered out! (uid out of range)
   *  ... skipping repetitive backtrace ...
(2026-07-16 12:58:43): [be[default]] [sdap_save_user] (0x0020): [RID#10] Failed to save user [apache@default]
   *  ... skipping repetitive backtrace ...
(2026-07-16 12:58:43): [be[default]] [dp_req_done] (0x0400): [RID#10] DP Request [Initgroups #10]: Request handler finished [0]: Success
(2026-07-16 12:58:43): [be[default]] [_dp_req_recv] (0x0400): [RID#10] DP Request [Initgroups #10]: Receiving request data.
(2026-07-16 12:58:43): [be[default]] [dp_req_destructor] (0x0400): [RID#10] DP Request [Initgroups #10]: Request removed.
(2026-07-16 12:58:43): [be[default]] [dp_req_destructor] (0x0400): [RID#10] Number of active DP request: 0
(2026-07-16 12:58:43): [be[default]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success

[alexey-tikhonov]

[be[default]] [sdap_save_user] (0x0040): [RID#10] User [apache@default] filtered out! (uid out of range)

Do you have ldap_min_id/ldap_max_id set in 'sssd.conf'?

[f1-outsourcing]

Yes I use min max id's I don't want to import 'remote' users/groups with low id's. I want to keep the ldap as a less secure source.

[alexey-tikhonov]

Yes I use min max id's I don't want to import 'remote' users/groups with low id's. I want to keep the ldap as a less secure source.

@sumit-bose, is ldap_rfc2307_fallback_to_local_users compatible with uid of local user being filtered out?

[sumit-bose]

Yes I use min max id's I don't want to import 'remote' users/groups with low id's. I want to keep the ldap as a less secure source.

@sumit-bose, is ldap_rfc2307_fallback_to_local_users compatible with uid of local user being filtered out?

Hi,

most probably not because if the request is filtered out it wouldn't progress so far in the backend. And I think this makes sense becasue if the configuration says SSSD should not care about the user it should not care about the group-memberships for this user either.

bye,
Sumit