https://fedorahosted.org/sssd/ticket/2066
Please note, that these patches has to be applied atop
0004-util-add-find_subdomain_by_sid.patch from my simple provider
patches. You can also pull it from branch ad-groups at my fedorapeople repo.
I still don't know why AD returns Domain Users from root domain in
tokenGroups, even though subaduser is not member of DU(a)ad.pb (AD bug
perhaps?), but with these patches we store it correctly.
This should be also a step forward to #2064.