Hi,
here are two patches for the IPA access provider. The first one checks
if the rule is enable or not the second should fix #475 by using the new
service attribute and object in the IPA schema. Although the code should
handle service groups it currently does not work, because the IPA server
does not set the memberOf attribute to the service objects. If this is
fixed on the server side service groups should work, too.
There are some areas of the code which are begging for refactoring, but
I think this is a post-1.2 task.
bye,
Sumit