https://fedorahosted.org/sssd/ticket/2026
I created a separate ticket to support subdomain users and groups in allow/deny lists. https://fedorahosted.org/sssd/ticket/2034
There is a bug in PAC responder at the moment which makes simple access provider to always deny access to subdomain users. PAC responder currently fails to resolve group membership, thus we get error in access provider when looking up groups and access is denied. Jakub will look into this.