• The RSA Authentication Agent for PAM is configured to challenge Active Directory users according to their AD group membership on a Linux operating system. 
• The agent is integrated with Active Directory using Winbind.
• Winbind fails to retrieve the group membership of AD users and thus, fails to challenge them for SecurID authentication. 

[root@rhel7 ~]# getent group ad_group
ad_group:x:16777224:user1,user2,user3,user4

[root@rhel7 ~]# getent group ad_group
ad_group:x:16777224:

1. As the root user, open the config file /etc/samba/smb.conf using a text editor. 
2. Find the section #--authconfig--end-line--.
3. Add the line winbind expand groups = 1 above #--authconfig--end-line--:

   ...
   winbind expand groups = 1
   #--authconfig--end-line--
   

4. Check that the smb.conf file is free of any syntax errors by running the command testparm:

   [root@rhel7 ~]# testparm
   Load smb config files from /etc/samba/smb.conf
   Processing section "[homes]"
   Processing section "[printers]"
   Processing section "[tmp]"
   Processing section "[html]"
   Loaded services file OK.

5. Restart the winbind service:

   [root@rhel7 ~]# service winbind restart

6. Test that the change resolved the issue by running getent group <group_name>:

   [root@rhel7 ~]# getent group ad_group
   ad_group:x:16777224:user1,user2,user3,user4