AD ID lookups - choose GC or LDAP as appropriate
    
    https://fedorahosted.org/sssd/ticket/1557
    
    Some lookups should be performed from GC only -- for example trusted
    users are only present in the Global Catalog, while some lookups should
    be performed from LDAP only as not all objects or attributes are
    replicated to Global Catalog.
    
    This patch adds a generic failover mechanism for identity lookups in the
    AD provider that allows to choose the appropriate source and even fail over
    to the other source if available.