There is no gidNumber attribute on AD group objects. If I want to apply posix attributes
directly in AD, then I don't need FreeIPA, do I...
https://blogs.technet.microsoft.com/activedirectoryua/2016/02/09/identity...
It is obvious that FreeIPA integration with AD is not production ready, and probably never
will be for numerous reasons, just like samba...