LDAP: tokengroups do not work with id_provider=ldap
    
    With plain LDAP provider we already have a sdap_handle, so it should be possible
    that in the case where sdom->pvt == NULL sdap_id_op_connect_send() can be
    skipped and sdap_get_ad_tokengroups_send() can be already send with the
    sdap_handle passed to sdap_ad_tokengroups_initgr_mapping_send(). So we should
    only fail if sdom->pvt == NULL and sh == NULL.
    
    if find_subdomain_by_sid() failed we can check if there is only one domain in
    the domain list (state->domain) and in this case continue with this domain since
    the LDAP provider does not know about sub-domains and hence can only have one
    configured domain.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2345
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>