Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1445028

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Group scope should be checked before adding a group as an external member. 'domain local' groups should not be allowed.

Implementation will most-likely need to add support of getting group scope from SSSD (RFE on SSSD side).

Reason to prevent it:
- Since 'domain local' groups are not available in the PAC for services outside the original domain. the IPA group wasn't added to the PAC and processing the PAC removed the membership to the IPA group.