Description of problem:

From xdong's description in bug #869616:

2> when adding duplicate AD user behaviour is different from regular duplicate
user

# ipa group-add-member --user=ttt aa
  Group name: aa
  Description: aaa
  External member: s-1-5-21-2048782538-2375889789-2933420090-1175,
s-1-5-21-2048782538-2375889789-2933420090-1176,
                   s-1-5-21-2048782538-2375889789-2933420090-1179,
s-1-5-21-2048782538-2375889789-2933420090-1155,
                   s-1-5-21-2048782538-2375889789-2933420090-1100
  Member users: ttt
  Member groups: ttt
  Failed members:
    member user: ttt: This entry is already a member
    member group:
-------------------------
Number of members added 0
-------------------------

# ipa group-add-member
--external=s-1-5-21-2048782538-2375889789-2933420090-1175 aa
[member user]:
[member group]:
  Group name: aa
  Description: aaa
  External member: s-1-5-21-2048782538-2375889789-2933420090-1175,
s-1-5-21-2048782538-2375889789-2933420090-1176,
                   s-1-5-21-2048782538-2375889789-2933420090-1179,
s-1-5-21-2048782538-2375889789-2933420090-1155,
                   s-1-5-21-2048782538-2375889789-2933420090-1100
  Member users: ttt
  Member groups: ttt
-------------------------
Number of members added 0
-------------------------

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-106.20121106T0229zgit881fc3a.el6.x86_64

How reproducible:
always


Steps to Reproduce:
1.  Setup IPA Master with trust to AD domain
2.  ipa group-add groupname --desc=desc --external
3.  ipa group-add-member groupname --external <SID|AD\name|name@ad.domain.com>
4.  ipa group-add-member groupname --external <SID|AD\name|name@ad.domain.com>

Actual results:
nothing added but, does not show "This entry is already a member" message like
with normal user/group members.

Expected results:
Shows the same error message.

Additional info: