[SSSD] [PATCH] NSS: Ignore default_domain for netgroups

[Jakub Hrozek]

Hi,

I think we shouldn't honor the default_domain_suffix for netgroup lookups
at all. The main use case for the option is to avoid entering the domain
for users from AD trusts, where you don't have netgroups on the AD
side. Moreover, netgroups don't play well eith fully qualified lookups
either way (see commit 1933ff17513da1d979dd22776a03478341ef5e6b).

Using default_domain_suffix for netgroups is actually harmful, because
hostgroups defined on an IPA server are translated into netgroups, so
honoring the suffix breaks sudo rules in the trust case.

As a side-effect, this patch should fix
https://fedorahosted.org/sssd/ticket/2400