All my concerns were addressed. CI passed: http://sssd-ci.duckdns.org/logs/job/24/37/summary.html Code is fine by me and my testing passed. ACK I think that this patch will be a real improvement for debugging HBAC issues, thanks Petr.