"type" permissions (e.g. --type=user) should use targetfilter instead of target (e.g. (targetfilter = "(objectclass=ipaUser)"))

To make sure this works with another, user-specified, filter, we need to allow multiple values in targetfilter and have --type work only on the objectclass one.

For additional flexibility, add targetattrfilter (also multi-valued).

Mailing list thread: http://www.redhat.com/archives/freeipa-devel/2013-December/msg00063.html