Description of problem:
In the xid to SID mapping function idmap_rid uses the trusted domain list to get the SID for the mapping domain.

But the idmap child may lack trusted domains in the case when before trusted domains enumeration finished a winbindd idmapping request came in that triggered the idmap child fork.

When it forks, the idmap child inherits the trusted domain list of the parent which is not yet complete. Even after the parent finishes trusted domain enumeration, xid2sid idmapping requets will continue to fail, so a transient error becomes a permanent one.

A successful authentication otoh will prime the idmap caches, so xid2sid will work as long as the cache remains valid. But obviously after flushing the cache or just cache expiration the idmapping will fail again.

The fix is to pass the domain sid as an additional argument to the idmap xid2sid mapping functions. To get the sid, we call lsalookupnames on the domain name of all domains in the mapping request


QA: We don't have a test for this. Would probably need testing with two domain forests and a child domain in one of the forests. So when we auth from a user from the child domain idmap_rid might fail because the idmap child doesn't know about it.

SanityOnly?