Description of problem:

It looks like we are unable to lookup Active Directory users after an AD Trust
is re-established from IPA.

Simple id command is where I'm seeing the failure

Before re-establishing trust:

[root@yttrium ~]# id aduser1@ipaad2012r2.test
uid=346213484(aduser1@ipaad2012r2.test) gid=346213484(aduser1@ipaad2012r2.test)
groups=346213484(aduser1@ipaad2012r2.test),346201110(adunigroup1@ipaad2012r2.te
st),346201108(adgroup1@ipaad2012r2.test),346201109(adgroup2@ipaad2012r2.test),3
46200513(domain users@ipaad2012r2.test)

After:

[root@yttrium ~]# id aduser1@ipaad2012r2.test
id: aduser1@ipaad2012r2.test: no such user

Version-Release number of selected component (if applicable):
ipa-server-4.5.0-21.el7_4.2.2.x86_64
sssd-1.15.2-50.el7_4.6.x86_64


How reproducible:
Unknown.  Results in automated tests are varied but a manual reproduction was
successful.

Steps to Reproduce:
1.  Install ipa-server with DNS and setup trust with AD.

note: my test env has AD forest with a root and subdomain.   and trust
defaulted to one-way initially I think.

2.  setup external group (not sure this step is actually necessary though but,
I did it while trying to reproduce this).

ipa group-add --desc=0 bz1049533_external --external
ipa group-add --desc=0 bz1049533
ipa group-add-member bz1049533_external --external='adgroup1@ipaad2012r2.test'
--users='' --groups=''

3.  Restart sssd and reset cache

systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd

4.  Re-establish trust

ipa trust-add ipaad2012r2.test --admin Administrator --range-type=ipa-ad-trust
--password --two-way=True

5. Lookup user

id aduser1@ipaad2012r2.test

Actual results:

[root@yttrium ~]# ipa trust-add ipaad2012r2.test --admin Administrator
--range-type=ipa-ad-trust --password --two-way=True
Active Directory domain administrator's password:
-------------------------------------------------
Re-established trust to domain "ipaad2012r2.test"
-------------------------------------------------
  Realm name: ipaad2012r2.test
  Domain NetBIOS name: IPAAD2012R2
  Domain Security Identifier: S-1-5-21-547465014-1205121312-3291251547
  Trust direction: Two-way trust
  Trust type: Active Directory domain
  Trust status: Established and verified

[root@yttrium ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service
sssd start
Redirecting to /bin/systemctl stop sssd.service
Redirecting to /bin/systemctl start sssd.service

[root@yttrium ~]# id aduser1@ipaad2012r2.test
id: aduser1@ipaad2012r2.test: no such user


Expected results:

I had expected to see the user returned like I did before I re-established the
trust.


Additional info: