===Copying from downstream BZ#1290853, apologies if this has been reported again upstream===

Description of problem:

In an IPA to AD trust environment, the AD trusted users stay in SSSD cache for much longer than expected. Actually, they stay in cache for a fixed amount of 10 hours while the IPA users for 5400 seconds (by default). The cache expiration options do not affect the trusted users as well.

In fact, we can see:

In src/providers/ipa/ipa_s2n_exop.c:

static errno_t ipa_s2n_save_objects(struct sss_domain_info dom,
struct req_input req_input,
struct resp_attrs attrs,
struct resp_attrs simple_attrs,
const char view_name,
struct sysdb_attrs override_attrs,
bool update_initgr_timeout)
{
int ret;
time_t now;
uint64_t timeout = 106060; / FIXME: find a better timeout ! /

That I believe is causing this issue.