Title: #309: HBAC: Do not rely on originalMemberOf, use the sysdb memberof links instead
This is a backport of the same fix we merged earlier.
The IPA HBAC code used to read the group members from the
originalMemberOf attribute value for performance reasons. However,
especially on IPA clients trusting an AD domain, the originalMemberOf
attribute value is often not synchronized correctly.
Instead of going through the work of maintaining both member/memberOf
and originalMemberOf, let's just do an ASQ search for the group names of
the groups the user is a member of in the cache and read their
To avoid clashing between similarly-named groups in IPA and in AD, we
look at the container of the group.
(cherry picked from commit c92e49144978ad3b6c9fffa8803ebdad8f6f5b18)
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/309/head:pr309
git checkout pr309