I'm sending couple patches which add support for IPA netgroups:
#53 These routines were not static, so I renamed them in order to avoid confusion and possible collision with equivalent routines in IPA provider
#54 Some new config options, please focus on this patch, I'm not entirely sure if my approach was the correct one.
#55 This new context was necessary so I can pass ipa options to routine determining host search base.
#56 This is netgroups support itself
#57 IPA id provider which is utilizing previously added support of netgroup fetching
Thanks Jan