The externalUser support has been broken with the introduction of the fully
qualified attributes, because the provider was saving the data verbatim,
but the sudo responder expects a fully qualified name.
Reproducer:
on the server:
ipa sudocmd-add --desc='For reading log files' /usr/bin/less
ipa sudorule-add readfiles
ipa sudorule-add-user --users=lcluser
ipa sudorule-mod --hostcat=all readfiles
then on the client:
   configure sssd with:
       id_provider = files
       sudo_provider = ipa
       ipa_domain = ipa.test
    run:
       sudo useradd lcluser
       sudo passwd lcluser
       su - lcluser
       sudo -l