diff --git a/0001-do-not-require-GID-for-non-POSIX-group.patch b/0001-do-not-require-GID-for-non-POSIX-group.patch
new file mode 100644
index 0000000..db6d370
--- /dev/null
+++ b/0001-do-not-require-GID-for-non-POSIX-group.patch
@@ -0,0 +1,79 @@
+Based on 7aa7344a20b3b31ae53ea790801254af42d525ed
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 9 Feb 2026 14:10:29 +0100
+Subject: [PATCH] sdap: do not require GID for non-POSIX group
+
+diff -up sssd-2.12.0/src/providers/ldap/sdap_async_groups.c.orig sssd-2.12.0/src/providers/ldap/sdap_async_groups.c
+--- sssd-2.12.0/src/providers/ldap/sdap_async_groups.c.orig	2026-01-14 15:59:45.560996918 +0100
++++ sssd-2.12.0/src/providers/ldap/sdap_async_groups.c	2026-04-02 10:34:30.367027491 +0200
+@@ -620,15 +620,17 @@ static int sdap_save_group(TALLOC_CTX *m
+                 goto done;
+             }
+ 
+-            ret = sysdb_attrs_get_uint32_t(attrs,
+-                                           opts->group_map[SDAP_AT_GROUP_GID].sys_name,
+-                                           &gid);
+-            if (ret != EOK) {
+-                DEBUG(SSSDBG_CRIT_FAILURE,
+-                      "no gid provided for [%s] in domain [%s].\n",
+-                          group_name, dom->name);
+-                ret = EINVAL;
+-                goto done;
++            if (posix_group) {
++                ret = sysdb_attrs_get_uint32_t(attrs,
++                                               opts->group_map[SDAP_AT_GROUP_GID].sys_name,
++                                               &gid);
++                if (ret != EOK) {
++                    DEBUG(SSSDBG_CRIT_FAILURE,
++                          "no gid provided for [%s] in domain [%s].\n",
++                              group_name, dom->name);
++                    ret = EINVAL;
++                    goto done;
++                }
+             }
+         }
+     }
+diff -up sssd-2.12.0/src/tests/tests/system/tests/test_identity.py.orig sssd-2.12.0/src/tests/tests/system/tests/test_identity.py
+--- sssd-2.12.0/src/tests/tests/system/tests/test_identity.py.orig	2026-01-14 15:59:45.611996896 +0100
++++ sssd-2.12.0/src/tests/tests/system/tests/test_identity.py	2026-04-02 10:34:30.368219151 +0200
+@@ -761,3 +761,40 @@ def test_identity__filter_groups_by_name
+ 
+     result = client.tools.getent.group(20001)
+     assert result is None, "Filtered group was found"
++
++
++@pytest.mark.importance("critical")
++@pytest.mark.topology(KnownTopologyGroup.AnyAD)
++def test_identity__nested_non_posix_group(client: Client, provider: GenericADProvider):
++    """
++    :title: Lookup indirect group-members of a nested non-POSIX group
++    :setup:
++        1. Add a new POSIX user and two new groups, one POSIX the other non-POSIX
++        2. Add the user to the non-POSIX group and the non-POSIX group to the POSIX group
++        3. Set 'ldap_id_mapping = false' to allow non-POSIX groups, because
++           with POSIX id-mapping enabled all groups will get POSIX ID and hence
++           there are no non-POSIX groups, and start SSSD
++    :steps:
++        1. Lookup the POSIX group with getent
++    :expectedresults:
++        1. Group is present and the new user is a member
++    :customerscenario: False
++    """
++    user = provider.user("nesteduser").add(
++        uid=10001, gid=20001, password="Secret123", gecos="User for tests", shell="/bin/bash"
++    )
++    nested_group = provider.group("nested_nonposix_group").add().add_member(user)
++    base_group = provider.group("posix_group").add(gid=30001).add_member(nested_group)
++
++    client.sssd.domain["ldap_id_mapping"] = "false"
++    client.sssd.start()
++
++    result = client.tools.getent.group(base_group.name)
++    assert result is not None, f"Group '{base_group.name}' not found!"
++    assert (
++        len(result.members) == 1
++    ), f"Group '{base_group.name}' has unexpected number of members [{len(result.members)}]!"
++    assert f"{user.name}" in result.members, f"Member '{user.name}' of group '{base_group.name}' not found!"
++
++    result = client.tools.getent.group(nested_group.name)
++    assert result is None, f"Non-POSIX Group '{nested_group.name}' was found with 'getent group'!"
diff --git a/sssd.spec b/sssd.spec
index b429aa3..41ef56c 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -21,7 +21,7 @@
 
 Name: sssd
 Version: 2.12.0
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: System Security Services Daemon
 License: GPL-3.0-or-later
 URL: https://github.com/SSSD/sssd/
@@ -29,6 +29,7 @@ Source0: https://github.com/SSSD/sssd/releases/download/2.12.0/sssd-2.12.0.tar.g
 Source1: sssd.sysusers
 
 ### Patches ###
+Patch1: 0001-do-not-require-GID-for-non-POSIX-group.patch
 
 ### Dependencies ###
 
@@ -1087,6 +1088,9 @@ fi
 %systemd_postun_with_restart sssd.service
 
 %changelog
+* Thu Apr 2 2026 Tomas Halman <thalman@redhat.com> - 2.12.0-2
+- Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group
+
 * Thu Jan 15 2026 Sumit Bose <sbose@redhat.com> - 2.12.0-1
 - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2
 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000]