I joined a domain as a secondary domain controller with
samba-tool domain join domain.com DC -U"admin"
Then I can see it successfully join the domain with the query:
realm list --all domain.com type: kerberos realm-name: DOMAIN.COM domain-name: domain.com configured: kerberos-member server-software: active-directory client-software: sssd required-package: sssd-tools required-package: sssd required-package: libnss-sss required-package: libpam-sss required-package: adcli required-package: samba-common-bin login-formats: %U login-policy: allow-realm-logins
I can list the users with
samba-tool user list
I don't understand why can't I do an id of a domain user such as firstname.lastname@example.org