After setting up a trust relationship AD users can access IPA hosts.
By default the allow_all HBAC rule permits general access.
By creating a special rule e.g. SSH access can be restricted.
Only members of the ssh_users group are allowed,
on any host for the sshd service.
Now SSH access for the AD user is rejected.
A new group is needed for external users like users from AD.
All member of the AD group CHILD\Domain Users shall be members of the new group.
Now the new group can be added to the ssh_users group to allow access to AD users.
Since in AD group and access information are stored in the PAC of the Kerberos ticket we have to get a fresh Kerberos ticket by removing the old one.
Now the AD user can access the IPA host again.