[SSSD] [PATCH] IPA: Use GC for group lookups in server mode

[Jakub Hrozek]

Hi,

the attached patch enables cross-domain group lookups.

Even though AD trusts often work with POSIX attributes which are
normally not replicated to GC, our group lookups are smart since commit
008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using
the LDAP connection and only use the GC connection to look up the members.

I tested the patch with trusts that use ID-mapping, there the
cross-domain memberships are resolved fine. 

For setups that use POSIX mapping, only the members from the domain that
the group belongs to is visible -- that is because the AD back end
currently tests if POSIX attributes are in use and if they are, GC
support is completely disabled. Perhaps this is something to work on in
1.13 when we refactor the group membership, but for now I'd like to keep
the patch (and associated risk) minimal.