In IPA-AD trust environment, how to configure sssd.conf to make sure that trusted AD users would be able to login without domain component

Issue

• In IPA-AD trust environment, how do I make sure that trusted AD users would be able to login without domain component on IPA client?

• For IPA -AD trust, set up an environment where Active Directory can be used as the primary user authentication source. Most user accounts would be stored in Active Directory with a handful of special purpose, Linux specific accounts (build accounts, for example) stored in IdM. When logging into a Linux IdM client with an Active Directory account, it is necessary to log in as aduser@ad.domain.com. This would be cumbersome for our end users and potentially lead to a number of transition issues.