There was a typo here and we weren't properly skipping memberOf
attributes in a user entry that contained fewer than four domain
components.
This can be reproduced by creating an HBAC rule that includes a specific
user. The FreeIPA server must also be using a single-component domain
(e.g. dc=freeipa as opposed to dc=example,dc=com)
Resolves
https://bugzilla.redhat.com/show_bug.cgi?id=733237