While working on migrating sudo group creation from OpenStackManager to Keystone hooks, @Andrew discovered that groups would not provide the expected output for an LDAP user unless LDAP records of type organizationalUnit existed for ou={people,groups},cn=$PROJECT,ou=projects,dc=wikimedia,dc=org. These OUs can be left empty and things will work as expected. The open question is what configuration in /etc/ldap* and the NSS config makes these groups expected. We would like to know why this is needed so that we can either change the config so we can reduce the number of placeholder records in LDAP or document the reason so that we aren't tempted to remove them again in the future.

See rOPUPc7dc72cbea0d: Keystonehooks: Add two more ldap ous for sudo handling.