kdb: support SMB services on IPA domain members
    
    SMB service on IPA domain member will have both ipaIDOjbect and ipaUser
    object classes. Such service will have to be treated as a user in order
    to issue MS-PAC record for it.
    
    Fixes: https://pagure.io/freeipa/issue/3999
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Christian Heimes <cheimes@redhat.com>