In my existing infrastructure, we have two domains of Active Directory. First domain is private.com and second is public.com. Public.com has been configured to one-way trust to private.com. All user accounts are handled in private.com. When I created linux server called linux.public.com, I can use user accounts from private.com to authenticate on that server using Winbind + Kerberos. However, the only problem that I experiencing is that whenever I changed group membership of one user account, linux.public.com doesn't reflected automatically. It will only reflected after the user account successfully authenticate on the server. Disabling "cached" on Winbind is still not working correctly.
My goal is to be able to use user accounts from private.com domain to public.com linux servers and would reflect the group memberships automatically when doing modification from active directory. Open source or free apps is highly preferable.
What solution could you recommend with my scenario?