cc42fe7 ipa: ignore objects from disabled domains on the client

1 file Authored by sbose 4 years ago, Committed by pbrezina 4 years ago,
    ipa: ignore objects from disabled domains on the client
    
    It is possible that a domain is already disabled on an IPA client but
    still  active on the server. This might happen e.g. if the version of
    SSSD running on the IPA server does not support disabled domains or if
    SSSD on the IPA client updates the domain data before the IPA server and
    sees a freshly disabled domain more early.
    
    As a result the server is still sending objects from disabled domains in
    the lists of group members or group memberships of a user. The client
    should just ignore those objects.
    
    Related to https://pagure.io/SSSD/sssd/issue/4078
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>