[SSSD] problem with AD nested group expansion, maybe?