On Tue, 12 Jul 2016, Sullivan, Daniel [AAA] wrote:
Justin,

I really appreciate you taking the time to respond to me.  This problem
is driving me crazy and I will certainly take any help I can get. My
suspicion is that the external user group in the policy below was
causing the log entry you specified, removing it from the policy does
not remediate the problem, even after flushing the client cache.

The way I have this setup is as follows:

1) I created a POSIX group in IPA named
'cri-cri_server_administrators_ipa' and allowed IPA to assign the GID.
2) I created an external group in IPA named
'cri-cri_server_administrators_external’ and added the AD group in the
trusted domain as an external member to this group
(cri-cri_server_administrat...@bsdad.uchicago.edu).
3) I added the group cri-cri_server_administrators_external' as a
member of 'cri-cri_server_administrators_ipa’

The HBAC rule is configured as (removing the external group does not
seem to make a difference).

[root@cri-ksysipadcp2 a.cri.dsullivan]# ipa hbacrule-show 
'cri-cri_server_administrators_allow_all'
 Rule name: cri-cri_server_administrators_allow_all
 Host category: all
 Service category: all
 Description: Allow anyone in 
cri-cri_server_administrat...@bsdad.uchicago.edu<mailto:cri-cri_server_administrat...@bsdad.uchicago.edu>
 to login to any machine
 Enabled: TRUE
 User Groups: cri-cri_server_administrators_external, 
cri-cri_server_administrators_ipa
[root@cri-ksysipadcp2 a.cri.dsullivan]#

For example, the problem still persists when the policy is configured in this 
manner:

[root@cri-ksysipadcp2 a.cri.dsullivan]# ipa hbacrule-show 
'cri-cri_server_administrators_allow_all'
 Rule name: cri-cri_server_administrators_allow_all
 Host category: all
 Service category: all
 Description: Allow anyone in cri-cri_server_administrat...@bsdad.uchicago.edu 
to login to any machine
 Enabled: TRUE
 User Groups: cri-cri_server_administrators_ipa

And my login validates against the host in question as follows:

As I said I have this working consistently (i.e. can flush the cash) on
another host with the same exact version of IPA and SSSD.  Here is a
validation of hbactest (works with either of the two policy
configurations above).
I think you problems are related to this snippet of your domain log
where SSSD on IPA client was unable to add membership of your user to
any of these groups:

(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[get_groups_dns] (0x0400): Root domain uses fully-qualified names,
objects might not be correctly added to groups with short names.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[get_groups_dns] (0x0400): Root domain uses fully-qualified names,
objects might not be correctly added to groups with short names.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[ipa_s2n_save_objects] (0x2000): Updating memberships for
a.cri.dsulli...@bsdad.uchicago.edu
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_sms_administrat...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_cvs_reposit...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-active_us...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaa-bar...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_develop...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group [name=aaa$
d...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=a.cri.dsulli...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_teleform_admins_p...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_isilon_sh...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-galaxy_web_us...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-hpc_allus...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-all_us...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaa-smau...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaa-azo...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-kraig_...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-cri_server_administrators_ipa,cn=groups,cn=ipa.cri.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_git_reposit...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_asap_adm...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaa-treebear...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group [name=domain
us...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group [name=bsd$
a.a...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=adm-dd-p...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=psm-...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-all_gro...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaagr...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-hpc_server_administrat...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_prodshop_lo...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-vandrogelen_...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-centrify_administrat...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_workflowgen_uat_adm...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_psom_redmine_adm...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-galaxy_administrat...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaa-dan_sulli...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=aaa-gpo-adm...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-dssg_...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-backup_adm...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_server_administrat...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-cri_server_administrat...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-aaa_teleform_admins_...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such
object](32)[ldb_wait: No such object (32)]
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory)
(Tue Jul 12 13:29:58 2016) [sssd[be[ipa.cri.uchicago.edu]]]
[sysdb_update_members_ex] (0x0020): Could not add member
[a.cri.dsulli...@bsdad.uchicago.edu] to group
[name=cri-train...@bsdad.uchicago.edu,cn=groups,cn=bsdad.uchicago.edu,cn=sysdb].
Skipping.

as result, the user is viewed by SSSD on this IPA client as not
belonging to the cri-cri_server_administrat...@bsdad.uchicago.edu group
and thus, HBAC rule validation on this client fails.

--
/ Alexander Bokovoy

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to