Otdfbt

I'm running a Samba Active Directory domain with Ubuntu 18.04 clients.

I used the /etc/security/group.conf file to successfully create a mapping for domain users to the "dialout" group. I tested it on a number of machines, and it worked fine...

rightmire@testpc:~$ groups
domain users dialout master BUILTIN+users rightmire

However, today for no apparent reason - it is no longer mapping the dialout group...

rightmire@testpc:~$ groups
domain users master BUILTIN+users rightmire

Re-running pam-auth-update does seem to see the groups.conf...

I'm not sure how to begin troubleshooting this. Searching for group.conf or pam-auth-update in the logs comes up with nothing. I'm not seeing anything pertinent in syslog or auth.log

===

FILES:

root@testpc:~# cat /etc/security/group.conf | sed '/^#/d'

*;*;*;Al0000-2400;dialout

root@testpc:~# cat /usr/share/pam-configs/my_groups
Name: activate /etc/security/group.conf
Default: yes
Priority: 900
Auth-Type: Primary
Auth:
 required pam_group.so use_first_pass

root@testpc:~# DEBIAN_FRONTEND=noninteractive pam-auth-update
root@testpc:~# 
(I.e. no error...)

UPDATE:

It seems that the problem only appears with su - user or local login (even though the local login is via the domain).

I.e. If I login via ssh as the user, the dialout group appears fine...

rightmire@localPC:~$ ssh rightmire@remotePC
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-46-generic x86_64)

(...snip...)

68 packages can be updated.
43 updates are security updates.

rightmire@remotePC:~$ groups
domain users dialout master BUILTIN+users 
rightmire@remotePC:~$

But if I su - rightmire, it does not appear...

root@remotePC:~# su - rightmire
rightmire@remotePC:~$ groups
domain users master BUILTIN+users domain admins denied rodc password replication group staff konstrukteure vicongroup h2t rightmire
rightmire@remotePC:~$

UPDATE

I have looked in the /etc/pam.d. The two files which contain a reference to pam_group.so are common-auth and login

./common-auth:auth required pam_group.so use_first_pass
./login:auth optional pam_group.so

However, the majority of the (login pertinent) files (including su and sudo which DON'T set the group, as well as sshd which DOES set the groups) include common-auth ...

./chfn:@include common-auth
./chsh:@include common-auth
./cron:@include common-auth
./cups:@include common-auth
./gdm-password:@include common-auth
./lightdm:@include common-auth
./login:@include common-auth
./other:@include common-auth
./polkit-1:@include common-auth
./samba:@include common-auth
./slock:@include common-auth
./sshd:@include common-auth
./su:@include common-auth
./sudo:@include common-auth