Title: #711: ipa: use only the global catalog service of the forest root
While creating the domains and sub-domains each domain gets a global
catalog services assigned but only one should be used because the global
catalog is by definition responsible for the whole forest so it does not
make sense to use a global catalog service for each domain and in the worst
case connect to the same GC multiple times.
In the AD provider this is simple because the GC service of the configured
domain AD_GC_SERVICE_NAME ("AD_GC") can be used. In the IPA case all
domains from the trusted forest are on the level of sub-domains so we have
to pick one. Since the forest root is linked from all domain of the same
forest it will be the most straight forward choice.
This would also be the proper fix for https://pagure.io/SSSD/sssd/issue/3015
the original fix for this ticket is reverted because it would cause other issues.
Related to https://pagure.io/SSSD/sssd/issue/3902
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/711/head:pr711
git checkout pr711