https://fedorahosted.org/sssd/ticket/2026
I created a separate ticket to support subdomain users and groups in
allow/deny lists.
https://fedorahosted.org/sssd/ticket/2034
There is a bug in PAC responder at the moment which makes simple access
provider to always deny access to subdomain users. PAC responder
currently fails to resolve group membership, thus we get error in access
provider when looking up groups and access is denied. Jakub will look
into this.