I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the distro's default repos. I have it configured for a one-way trust to an Active Directory deployment. On the client side, I have installed and configured the freeipa-client package version 4.7.0 on Ubuntu 18.04. This is all basically working as advertised according to the docs.
However, when I log into the client with an AD account and run the id command, I'm seeing all of my AD groups listed. Is there a way to have FreeIPA completely ignore all groups from AD when dealing with external users? The ultimate goal (and let me know if this is beyond FreeIPA's capabiltiies) is to ignore/discard all groups in AD and manage users instead by groups in FreeIPA.
One thing I did try was adding these options to the domain section of sssd.conf on the FreeIPA server, but they didn't have any effect and I suspect I don't fully understand what they are for:
ignore_group_members = True
subdomain_inherit = ignore_group_members
Thanks for any advice, even if it's "hey, don't do that".
