The suite(s) should test the following scenarios regarding short name authentication in indirect AD integration scenario:

Basic CRUD:

• adding/removing domains from DRO (pass)
• adding empty DRO (pass)
• adding non-existent domains to DRO (error)
• adding removed AD domain to DRO (error)
• adding disabled AD domain to DRO (error)

Logins:

• set the global domain resolution order to IPA and Ad domains and verify all users can login with short names
• remove an AD domain from global DRO and verify all users except those from removed domain can login w/ short names
• remove an IPA domain from DRO and verify that no IPA users can login w/ short name
• depending on SSSD implementation, set global DRO to empty value and see what happens (either revert to default behavior or enforce fully qualified names for all users_

Then test also the interplay between global and view-specific DRO:

• set all domains in global config, set only one domain on view, apply view on the client, verify that only the DRO from view is applied
• set an IPA domain in global DRO, set AD domains in view-specific DRO, verify that only the AD users can now use short names to login when the view is applied

More test cases may be added when necessary.