Topology: We have AD (ad.domain) with child domain (child.ad.domain) and linux machine joined directly to AD domain.

If user from ad.domain is a member of group from child domain running `id` command shows that all his domains are from ad.domain

How reproducible: Allways

Steps to reproduce

1. Create AD (ad.domain) with child domain (child.ad.domain)
2. enroll linux machine into AD
3. In AD create user (user1@ad.domain), create universal group in child domain (childgroup1@child.ad.domain)
4. set ldap_use_tokengroups to False for the domain
5. Make user1@ad.domain member of childgroup1@child.ad.domain
6. remove SSSD cache, restart SSSD
7. run `id user1@ad.domain`

Expected results

id user1@ad.test
uid=1206201105(user1@ad.domain) gid=1206201105(user1@ad.domain) groups=1206201105(user1@ad.domain),1689801105(childgroup1@child.ad.domain),...

Actual results

id user1@ad.test
uid=1206201105(user1@ad.domain) gid=1206201105(user1@ad.domain) groups=1206201105(user1@ad.domain),1689801105(childgroup1@ad.domain),...