[SSSD] Why is SUA needed for SSSD to work with a Microsoft AD LDAP server?