Description of problem:
Note this is not affecting the impacted customer at this time,
ignore_group_members = True was used to workaround this problem.

In the default SSSD AD Trust configuration, group membership lookups may lead
to unexpected user objects being retrieved and searched in the override/views
codepath. The '(' or ')' characters are allowed in AD but cause a bad search
filter to be created by SSSD.

...
[ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed:
[1432158245]: Malformed search filter

Version-Release number of selected component (if applicable):
sssd-1.15

How reproducible:
Always in customer environment

Steps to Reproduce:
1. Add user with '(' character as a member of group in Active Directory
2. Attempt to login as AD user in the same group, or any user which would
trigger getgr* calls to a group which returns this bad character user

Actual results:
Bad Search filter

Expected results:
Lookup succeeds

Additional info:
The following options were added to successfully workaround this problem:

subdomain_inherit = ignore_group_members
ignore_group_members = True