Description of problem:


Version-Release number of selected component (if applicable):
ipa-server-2.1.2-2.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. [root@bumblebee ~]# ipa group-show hbacusers 
  Group name: hbacusers
  Description: hbac users
  GID: 1988800005
  Member groups: ipausers
  Indirect Member users: shanks, ipatest23573

2. [root@bumblebee ~]# ipa hbacrule-show rule2 
  Rule name: rule2
  Enabled: TRUE
  User Groups: hbacusers
  Hosts: bumblebee.lab.eng.pnq.redhat.com
  Source Hosts: mudflap.lab.eng.pnq.redhat.com
  Services: vsftpd
  External host: external.lab.eng.pnq.redhat.com

3. [root@bumblebee ~]# ipa hbactest --user=shanks --srchost=external.lab.eng.pnq.redhat.com --host=bumblebee.lab.eng.pnq.redhat.com --service=vsftpd



Actual results: 
---------------------
Access granted: False
---------------------
  notmatched: rule2

Expected results: 
---------------------
Access granted: True
---------------------
  matched: rule2


Additional info: