I already have the AD integration working via sssd where a user logging in is a member of one of two AD groups. They are able to ssh into the server and if it's their first login they're granted access with their home directory forced to /home/%d/%u. This works as expected and now I would like to automatically assign these users to local linux groups in ubuntu based upon their AD group membership. Initially, one group will need to be added to a single group (www-data) while the second group would need access to www-data and the sudo group. As this is an initial pass at this, I've kept it simple, but this will be expanding and I would like to avoid having to manually add these users to the groups, which works currently.
The membership of the AD groups are dynamic and as such, any changes to the groups should ideally be reflected locally. Is there a mechanism that I have missed through the various sssd, kerberos tutorials? I've considered using a cron script that runs every hours to poll for changes, but if something already exists in sssd/pam/kerberos configs, I would like to utilize that.