IPA: Use the correct domain when processing SELinux rules
    
    We blindly used the user's domain for everything. That wrong in case the
    user comes from a subdomain. We should use the IPA domain for accessing
    the SELinux rules and host data and the user domain only for the user.
    
    https://fedorahosted.org/sssd/ticket/2270
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>