Title: #246: filter_users and filter_groups stop working properly in v 1.15
Hi, we should solve this on `cache_req` level so we get the same resultt in `nss` and
`ifp` (and others) responders. What I had in mind was to create another plugin function
that will be called in the and of `cache_req` process. I.e. something like this:
* Filter the result through negative cache.
* This is useful for plugins that don't use name as an input token but can be
affected by filter_users and filter_groups options.
* @return EOK If the object is not found.
* @return EEXIST If the object is found in negative cache.
* @return Other errno code in case of an error.
(*cache_req_ncache_filter_fn)(struct sss_nc_ctx *ncache,
struct sss_domain_info *domain,
struct ldb_message *msg);
In the end, we should iterate over the result and pass each ldb_message to the function
(if defined) and remove it from the result if it is present in the negative cache.
See the full comment at https://github.com/SSSD/sssd/pull/246#issuecomment-296985950