With multiple separate forests trusted by IPA server, IPA client returns invalid group membership info:

$ id testuser2@tbad2.idm.lab.eng.brq.redhat.com
uid=1104001106(testuser2@tbad2.idm.lab.eng.brq.redhat.com)
gid=1104001106(testuser2@tbad2.idm.lab.eng.brq.redhat.com@tbad.idm.lab.eng.brq.redhat.com)
groups=1104001106(testuser2@tbad2.idm.lab.eng.brq.redhat.com@tbad.idm.lab.eng.brq.redhat.com)

Note the testuser2@ tbad2.idm.lab.eng.brq.redhat.com@ tbad.idm.lab.eng.brq.redhat.com group. Tbad and tbad2 are root domains of separate forests.

What happens here is the following:
1. User on IPA client wants to resolve GID belonging to group from tbad2, second trusted domain
2. IPA client uses SSSD to resolve the GID
3. SSSD tries to resolve the GID in the IPA domain. No success.
4. SSSD tries to resolve the GID in the first trusted domain.
5. SSSD leverages extop plugin on IPA server to resolve the GID
6. Extop plugin uses SSSD on the IPA server to resolve the GID
7. SSSD on the IPA server resolves GID, but uses any of the configured domains for the resolution. It finds the GID in the second trusted domain. Returns testuser2@ tbad2.idm.lab.eng.brq.redhat.com to the extop plugin.
8. Extop plugin tries to strip off the domain @tbad.idm.lab.eng.brq.redhat.com, since the SSSD expects the non-qualified name. However, the domain it does not match with testuser2@ tbad2.idm.lab.eng.brq.redhat.com and therefore nothing is stripped. Returns the result to the SSSD on the client.
9. SSSD on the client gets the result. Expecting non-qualified name, it appends the domain name of the current domain being searched, which is first trusted domain, that is @tbad.idm.lab.eng.brq.redhat.com
10. The GID is resolved to testuser2@ tbad2.idm.lab.eng.brq.redhat.com@ tbad.idm.lab.eng.brq.redhat.com.

The extop plugin needs check for the domain name of the result returned from server's SSSD. If the domains do not match, no result should be returned. This will make SSSD on the server iterate over to the correct domain.