Comment 16 for bug 1024475

At some point, this started working again after a dist-upgrade, so nss_initgroups_ignoreusers is working for me.

The only thing I've done on top of that for house keeping purposes, is to modify the init script to remove the ignoreusers line on system start (the configs are controlled vi puppet, and the file will keep changing otherwise).

For anyone else with a similar issue, I'm using this:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#! /bin/sh -e

### BEGIN INIT INFO
# Provides: libnss-ldap
# Required-Start:
# Required-Stop: mountall.sh
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Updates /etc/ldap.conf
# Description: Updates nss_initgroups_ignoreusers based on
# nss_initgroups_minimum_uid
### END INIT INFO

PATH="/sbin:/bin:/usr/sbin:/usr/bin"
. /lib/lsb/init-functions

case "$1" in
 start)
  log_action_begin_msg "Removing nssldap-update-ignoreusers changes"
  if sed -i "/^nss_initgroups_ignoreusers/d" /etc/ldap.conf ; then
   log_action_end_msg 0
  else
   log_action_end_msg 1
   exit 1
  fi
  ;;
 restart|force-reload|stop)
  log_action_begin_msg "Running nssldap-update-ignoreusers"
  if nssldap-update-ignoreusers ; then
   log_action_end_msg 0
  else
   log_action_end_msg 1
   exit 1
  fi
  ;;
 *)
  echo "Usage: $0 {start|restart|force-reload|stop}"
  exit 1
 ;;
esac
exit 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~