Hi,

it seem that your schema doesn't match the defaults or you home some configuration issue. Could you please execute following and send us the output for your IPA setup?

  ovirt-engine-extensions-tool --log-level=FINE aaa authz-fetch_principal_record --authz-flag=resolve-groups-recursive --authz-flag=resolve-groups --extension-name=<PROFILE-NAME> --principal-name=<USERNAME>

The above will search for a user by <USERNAME> and tries to fetch all groups he is member of.

Btw you can test both "search users/groups" and "login a user" during aaa-ldap-setup tool (and it's recommended to do so) and the output from those commands should provide you the same details.

Thanks

Martin Perina