Bind Secondary Groups to Active Directory w/ Unix Extensions

Solution 1:

It sounds like you have the user records' gid attribute mapped, but not the group records' gid. You can check this from the command line with dsconfigad:

$ sudo dsconfigad -show
[...]
Advanced Options - Mappings
  Mapping UID to attribute       = uidNumber
  Mapping user GID to attribute  = gidNumber
  Mapping group GID to attribute = gidNumber
  Generate Kerberos authority    = Enabled
[...]

Note the "Mapping group GID to attribute = gidNumber" -- that's what I think you're missing. You can set it from the command line with sudo dsconfigad -ggid gidNumber, on with the GUI program /System/Library/CoreServices/Directory Utility.app (click the padlock to authenticate as admin, double-click the Active Directory connector, click the triangle to "Show Advanced Options", click the Mappings tab, then enable "Map group HID to attribute" and set it to "gidNumber").