Title: #475: AD: Use the right sdap_domain for the forest root
The code looks good and does not cause any issues for me.
Unfortunately I was not able to reproduce the issue, mainly because I currently do not
have a chance to add a third AD domain to my test environment. @lslebodn, would you mind
to run the tests?
See the full comment at https://github.com/SSSD/sssd/pull/475#issuecomment-358891271