I am currently looking at migrating my existing CentOS6 servers over to CentOS7 and am currently testing out my sssd configuration on the new build with some issues. For some reason I am unable to see any secondary groups for my user like I would expect, and the /etc/sssd.conf, /etc/nsswitch and related /etc/pam.d configurations should be the same for both my CentOS6 and 7 servers (Configuration is currently puppetized). I did see a related issue with the default setting for initgroups to be files only, but I have already adjusted my configs for that with little success. Any help is greatly appreciated!

Setup Detail

Authentication Server: MS 2008R2
Schema Type: ad

/etc/sssd/sssd.conf
[sssd]
services = nss, pam, autofs config_file_version = 2
domains = example.com debug_level = 9
enumerate = false cache_credentials = true

[nss]
filter_groups = root filter_users = root reconnection_retries = 3

[pam]
reconnection_retries = 3

[autofs]
ldap_autofs_search_base = CN=automount,dc=example,dc=com

## Domain Configurations
[domain/example.com]
debug_level = 9
id_provider = ldap access_provider = ldap auth_provider = krb5

ldap_uri = ldap://ad.example.com ldap_tls_reqcert = allow ldap_schema = rfc2307bis ldap_referrals = false ldap_disable_referrals = true ldap_force_upper_case_realm = true ldap_page_size = 4000
ldap_access_order = expire ldap_account_expire_policy = ad ldap_default_bind_dn = CN=LINUXAUTH,DC=EXAMPLE,DC=COM
ldap_id_mapping = False ldap_search_base = DC=EXAMPLE,DC=COM

ldap_user_search_base = DC=EXAMPLE,DC=COM?subtree?&(objectclass=user)(uidnumber=*)
ldap_user_search_scope = sub ldap_user_object_class = user ldap_user_name = cn ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_user_shell = loginShell ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_objectsid = objectSid ldap_user_member_of = memberOf ldap_user_gecos = cn

ldap_group_search_base = DC=EXAMPLE,DC=COM?subtree?&(objectclass=group)(gidnumber=*)
ldap_group_objectsid = objectSid ldap_group_member = member ldap_group_object_class = group ldap_group_uuid = objectGUID
ldap_group_nesting_level = 0

krb5_auth_timeout = 5
krb5_renew_interval = 60
krb5_realm = EXAMPLE.COM
krb5_server = ad.example.com ldap_krb5_init_creds = true

/etc/nsswitch

passwd: files sss shadow: files sss group: files sss initgroups: files sss hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: files sss publickey: nisplus automount: files sss aliases: files nisplus