URL:
https://github.com/SSSD/sssd/pull/209
Title: #209: IPA: lookup AD users by certificates on IPA clients
sumit-bose commented:
"""
It is expected that ListByCertificate returns matches from all domains. So as long as all
the listed users have the certficate in their corresponding user object (I assume you are
not using other certmap rules), the result is expected.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/209#issuecomment-290065881