I think you are assuming wrongly that --usercat option is or specifying groups. It is not. It only accepts "all" value to allow applying this rule to all users.

To add user groups to the rule use ipa hbacrule-add-user test --groups=test.

To see all commands supported for HBAC rules use ipa help hbacrule and to get help for each command use help command with a specific command: ipa help hbacrule-add-user.

I know that --usercat only allows users, RFE is to create another parameter to assign groups in the creation of the rule, for example: --groupcat

User categories != groups. User categories may give you an impression of a group-related functionality but they aren't and never were intended for this usage.

If you want to add groups to the rule, use that special command I pointed you to in my comment.

What is a real use case you are trying to solve? A number of objects in FreeIPA are management in multi-step approach:

1. A rule is created
2. Associated objects added to the rule
3. Rule is activated for use

HBAC rules follow this scheme, as well as SUDO rules, roles, privileges, and many other objects.

I don't think we should complicate rule creation by stuffing all these options into the same command. We have family of commands for a reason.

I don't think we should complicate rule creation by stuffing all these options into the same command. We have family of commands for a reason.