In AD I have 'Domain Users' which is a member of a basic group called 'nestedtestgroup'

When tokengroups is disabled and my primary group is Domain Users, running id does not find 'nestedtestgroup'

[root@rhel6-sssd-ad ~]# id justintime@jstephen.local
uid=489246999(justintime@jstephen.local) gid=489200513(domain users@jstephen.local) groups=489200513(domain users@jstephen.local),489201114(largegroup@jstephen.local)

If I change my primary group to a different group such as 'largegroup', or turn tokengroups on then the group is visible

[root@rhel6-sssd-ad ~]# id justintime@jstephen.local
uid=489246999(justintime@jstephen.local) gid=489201114 groups=489201114(largegroup@jstephen.local),489200513(domain users@jstephen.local),489247023(nestedtestgroup@jstephen.local)

Jakub's input:
With tokengroups we get the list of all SIDs the user is a member of,
including the parent group of the primary group, during the initgroups
operation, so the grouplist is complete. Normally, when we return the
grouplist during the initgroups operation, we return all the groups the
user is an explicit member of plus their primary group.

In contrast, when tokengroups are disabled, we run ldapsearches in the
rough form of:
1) objectclass=group and member=userDN <-- to get direct parents
2) then for each direct parent, until we either stop receiving groups
or hit the nesting limit
for groupdn dn this_nesting_level_groups:
objectclass=group and member=groupdn
but we only loop through the non-primary groups in the generic
LDAP code, because normally in LDAP, admins don't add parent
groups of the primary group.

I think what happens when tokengroups are disabled is that we don't
receive the parent group of the primary group from LDAP in some explicit
list like we do with tokengroups and we neither explicitly search for
it -- which I think is the missing piece.