Hi,
the attached patches implement
https://fedorahosted.org/sssd/ticket/1962. When a new option,
ipa_server_mode is set to True, then subdomain/trusted users are not
looked up using the extop plugin but AD ID context is initialized and
the users are looked up directly with AD code. This is in support of
legacy clients looking up trusted AD users and groups.