hbactest does not work for external users
    
    Original patch for ticket #3803 implemented support to resolve SIDs
    through SSSD. However, it also broke hbactest for external users. The
    result of the updated external member group search must be local
    non-external groups, not the external ones. Otherwise the rule is not
    matched.
    
    https://fedorahosted.org/freeipa/ticket/3803