Description of problem:

Users are not showing in ypcat output but they show in cn=compat.

# ipa netgroup-add --desc=ng1 ng1
# ipa netgroup-add-member --users=admin --hosts=dane ng1

# ypcat -k -h dane -d greyoak.com netgroup
ng1 (dane.greyoak.com,-,greyoak.com)

# ldapsearch -LLL -x -b 'cn=ng,cn=compat,dc=greyoak,dc=com'
dn: cn=ng,cn=compat, dc=greyoak,dc=com
objectClass: extensibleObject
cn: ng

dn: cn=ng1,cn=ng,cn=compat,dc=greyoak,dc=com
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (dane.greyoak.com,admin,greyoak.com)
cn: ng1

Adding additional users to the netgroup don't show either:

# ipa netgroup-add-member --users=ttest ng1
  Netgroup name: ng1
  Description: ng1
  NIS domain name: greyoak.com
  Member User: admin, ttest
  Member Host: dane.greyoak.com
-------------------------
Number of members added 1
-------------------------
# ypcat -k -h dane -d greyoak.com netgroup
ng1 (dane.greyoak.com,-,greyoak.com)

#  ldapsearch -LLL -x -b 'cn=ng,cn=compat,dc=greyoak,dc=com'
dn: cn=ng,cn=compat, dc=greyoak,dc=com
objectClass: extensibleObject
cn: ng

dn: cn=ng1,cn=ng,cn=compat,dc=greyoak,dc=com
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (dane.greyoak.com,admin,greyoak.com)
nisNetgroupTriple: (-,ttest,greyoak.com)
cn: ng1

Version-Release number of selected component (if applicable):

ipa-server-2.1.3-4.el6.i686