Title: #243: IPA: Use search bases from sdap_domain instead of inferring search base from
IPA domain structure
This PR fixes https://pagure.io/SSSD/sssd/issue/3378
To test the patch, add some external groups (ipa group-add --external)
that contain members from a trusted AD domain on an IPA server. Then,
resolve the AD domain object.
Before the patch, the search for the ipaExternalGroup class objects would
have been based on the root search base of the IPA server, after the patch
it should be based on the cn=accounts subtree.
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/243/head:pr243
git checkout pr243