I was testing with a subdomain user who was a member of IPA group and
found out the extdom plugin didn't handle the IPA group well, because
the group name wasn't qualified.
Is handling this situation on the client (as opposed to changing the
server so that all group names are qualified) the right approach?