As there is the minimal domain level setting MIN_DOMAIN_LEVEL, it should be used instead of DOMAIN_LEVEL_0. See: https://pagure.io/freeipa/issue/7669 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>