realmd 'realm permit' command fails with "does not match the login format" when permitting users from a trusted Active Directory domain

Issue

• When attempting to restrict or permit login access for a user or group belonging to a trusted AD domain using the realm permit command, it fails with:

# realm permit user@trusted-domain.com
See: journalctl REALMD_OPERATION=r306573.148004
realm: Couldn't change permitted logins: Invalid login argument 'user@trusted-domain.com' does not match the login format.

• SSSD resolves the trusted user perfectly. Commands such as id user@trusted-domain.com or getent passwd user@trusted-domain.com succeed and return the correct UID, GID, and AD groups.

• The local system is joined to a child subdomain or specific realm, and the user to be permitted belongs to the parent domain or a sister trusted domain.