Title: #239: HBAC: Use memberof ASQ search instead of originalMemberOf
This PR should fix the bug we were seeing in the HBAC evaluation of users
from a trusted AD domain where the originalMemberOf didn't match the
Because maintaining the originalMemberOf attributes is fragile, let's
instead dereference the memberOf attribute and look at the names of the groups
To make sure we only consider IPA groups and not groups from trusted
domains, we construct a base DN of the IPA domain sysdb group container
and pop the RDN from the DN of the object examined and compare the two.
If other developers think it's too much of a hack, we can just search the
IPA domain with a BASE search and the group DN. A BASE search is just a
direct lookup on the LDB level, so it wouldn't be too slow either.
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/239/head:pr239
git checkout pr239