We have an (active directory) LDAP server and I'm trying to use libnss-ldap to resolve ldap users and groups. When I run 'getent passwd', all of the users are returned exactly like I'd expect. However, when I run 'getent group' all of the system groups are returned immediately and then the process hangs and then seems to give up.
passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis
host 126.96.36.199 188.8.131.52 base DC=ad,DC=domain,DC=tld binddn CN=pamldap,OU=Service Accounts,OU=GSS,DC=ad,DC=domain,DC=tld bindpw somepass uri ldap://ad.domain.tld/ ldap_version 3 nss_paged_results yes pagesize 10000 nss_base_passwd OU=Users,OU=GSS,DC=ad,DC=domain,DC=tld nss_base_shadow OU=Users,OU=GSS,DC=ad,DC=domain,DC=tld nss_base_group OU=Centers,OU=Groups,OU=GSS,DC=ad,DC=domain,DC=tld nss_map_objectclass posixAccount user nss_map_objectclass shadowAccount user nss_map_attribute uid sAMAccountName nss_map_attribute homeDirectory unixHomeDirectory nss_map_attribute shadowLastChange pwdLastSet nss_map_objectclass posixGroup group nss_map_attribute uniqueMember member pam_login_attribute sAMAccountName pam_filter objectclass=User pam_password ad
BASE OU=GSS,DC=ad,DC=domain,DC=tld URI ldap://ad.domain.tld TLS_CACERT /etc/ssl/certs/ca-certificates.crt
I looked through everything I could find and wasn't able to find anything with the same issue. Hopefully someone can slap me in the face with something really obvious and trivial that I'm doing wrong.