Linux: Converting from NIS to AD auth, how to associate old UID/GID to "new" users?

Solution 1:

Yes, sssd can use the POSIX attributes from AD instead of doing its own ID mapping.

In the section for your AD domain in /etc/sssd/sssd.conf, simply set ldap_id_mapping = false.

If you have already used sssd's automatic ID mapping on a computer, be sure to clear its cache before you restart sssd.

rm -f /var/lib/sss/db/*

When using realm join to join a new computer to the domain, include the command line option --automatic-id-mapping=no.