How to make debian see all groups of a user in ldap?

Question

linux

There is one old, old server on debian, the only task of which is to give some resources to users that are stored in ldap on another server. It has been working for 100 years already, and everything seems to be normal, but periodically it gives a thrashing where it should give good.
Began to understand - it turns out he sees only the default group of the user!
That is something like this:

Для локального
id administrator
uid=1000(administrator) gid=1000(administrator) группы=1000(administrator),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)

Для лдап
uid=15000(user)) gid=10000(domainadmins) группы=10000(domainadmins)

Although the ldap user also has many groups.
Thus the user logs in normally. And getent group shows all groups correctly.
Where to dig?
Below connection settings:
cat /etc/nslcd.conf
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.
# The user and group nslcd should run as.
uid nslcd
gid nslcd
#log syslog
# The location at which the LDAP server(s) should be reachable.
uri ldap://192.168.2.254
# The search base that will be used for all queries.
base dc=fs,dc=lan
# The LDAP protocol version to use.
ldap_version 3
#pam_password md5
# The DN to bind with for normal lookups.
#binddn cn=user,dc=fs,dc=lan
#bindpw password
# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com
# SSL options
ssl no
#tls_reqcert never
# The search scope.
scope sub
#nss_nested_groups yes
#off# automatically commented out next line because this is now the default
#off# map group uniqueMember member

Answer 1

In general, my stupidity and inattention. Some time ago I migrated from openldap to freeipa. The authors of the latter directly say - if you want to directly climb requests into ldap, turn on the compatibility mode and look for a separate branch dc=compat,dc=domain,dc=loc It maintains compatibility with rfc.
Actually, I didn't check it, I just reconfigured debian to freeipa-client, that's it. But later I encountered the fact that openfire also does not see the user's belonging to groups. Having written to the mailing list, I received a kick in the direction of the documentation.

Answer 2

This can help?
www.yolinux.com/TUTORIALS/LinuxTutorialLDAP.html#Y...