The attached patch fixes issues with logging in as users without an
explicit UPN in a trust scenario. The simplest reproducer is to log in
as Administrator or configure sssd to not look up the principal
attribute by adding this to the server's sssd.conf
subdomain_inherit = ldap_user_principal
ldap_user_principal = nosuchatt
Please see the commit message for more details.