IPA: Only attempt migration for the joined domain
    
    After the recent changes in commit a5e134b22aa27ff6cd66a7ff47089788ebc098a1
    to fix ticket #3394, the PAM_CRED_ERR error would try to start migration
    for any account. Further down the request, a sysdb search would try to find
    the user in the joined domain only because the migration code presumes the
    user is in the IPA domain which would error out and return System Error
    to the PAM client.
    
    This patch changes the migration somewhat to only attempt the migration
    for IPA users.
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>