[SSSD] Question regarding domain-local groups filtering