IPA HBAC problems

# this is the group (and ad mapping group) of the test user:

[[email protected] ~]$ ipa group_show 'org_-_uk_core_it'
  Group name: org_-_uk_core_it
  GID: 1517232518
  Member groups: org_-_uk_core_it_external
  Member of Sudo rule: org_-_uk_core_it|auto_r_etcd_test|all
  Member of HBAC rule: test_user_test, systems_datacenter|all|all

[[email protected] ~]$ ipa group_show 'org_-_uk_core_it_external'
  Group name: org_-_uk_core_it_external
  External member: org - uk core [email protected]
  Member of groups: org_-_uk_core_it
  Indirect Member of Sudo rule: org_-_uk_core_it|auto_r_etcd_test|all
  Indirect Member of HBAC rule: test_user_test, systems_datacenter|all|all

# this is the new HBAC rule.

[[email protected] ~]$ ipa hbacrule_show test_user_test
  Rule name: test_user_test
  Host category: all
  Enabled: TRUE
  User Groups: org_-_uk_core_it
  Services: sshd, sudo, sudo-i

# This is an old HBAC rule
[[email protected] ~]$ ipa hbacrule_show 'systems_datacenter|all|all'
  Rule name: systems_datacenter|all|all
  Host category: all
  Enabled: TRUE
  User Groups: ad_org_-_unix_team
  Services: sshd, sudo, sudo-i


# hbactest finds no rule that would allow [email protected] to access etcdtest-2.test.nj.dc.linux.example.com
[[email protected] ~]$ ipa hbactest --user [email protected] --host etcdtest-2.test.nj.dc.linux.example.com --service sshd |egrep '(Access granted|Matched rules)'
Access granted: False

# if specifing --rules test_user_test hbactest recongnizes that this rule would allow access to etcdtest-2.test.nj.dc.linux.example.com
[[email protected] ~]$ ipa hbactest --user [email protected] --host etcdtest-2.test.nj.dc.linux.example.com --service sshd --rules test_user_test |egrep '(Access granted|Matched rules)'
Access granted: True
  Matched rules: test_user_test

# lets add the usergroup org_-_uk_core_it to the old HBAC rule
[[email protected] ~]$ ipa hbacrule-add-user 'systems_datacenter|all|all' --groups 'org_-_uk_core_it'
  Rule name: systems_datacenter|all|all
  Host category: all
  Enabled: TRUE
  User Groups: ad_org_-_unix_team, org_-_uk_core_it
  Services: sshd, sudo, sudo-i
-------------------------
Number of members added 1
-------------------------

# hbac test now grants access by matched rule systems_datacenter|all|all
[[email protected] ~]$ ipa hbactest --user [email protected] --host etcdtest-2.test.nj.dc.linux.example.com --service sshd|egrep '(Access granted|Matched rules)'
Access granted: True
  Matched rules: systems_datacenter|all|all


info:

linux.example.com: is the IPA REALM
pc.example.com: is an AD REALM (trusted by linux.example.com)
[email protected]: is an AD user