idmap_ad creates an incorrect local krb5.conf in case of trusted domain lookups.

In case we have idmap_ad and trusted domain and connect to a trusted domain we create a krb5.conf for our realm but with the IP of the trusted domain KDC. Thus we try to get a krbtgt from the trusted domain for our machine account and fail. The trusted domain KDC doesn't know about our machine account.

We need to look up the KDC IP in this case instead of providing one.