Request for enhancement

As admin , I want to create an HBAC rule for a group of users, on a group of hosts, that can login only, no sudo, etc

Issue

However they can only login if the "Any Service" is selected. Even if every available service is added/enabled, they can't login but only if the "Any Service" is selected.

Steps to Reproduce

1. create user group
2. create host group
3. create HBAC rule with login service
4. attempt to login

Actual behavior

Can't login

Expected behavior

Can login

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.8-7.module+el8.6.0+14337+19b76db2.x86_64
ipa-client-4.9.8-7.module+el8.6.0+14337+19b76db2.x86_64
389-ds-base-1.4.3.28-6.module+el8.6.0+14129+983ceada.x86_64
pki-ca-10.12.0-2.module+el8.6.0+14115+8b467244.noarch
krb5-server-1.18.2-14.el8.x86_64

Additional info:

These are stig'd, and CAC enabled hosts and users.
When "Any Service" is selected, can login, when all servcies are manually added, seeing PREAUTH error in IDM.
So turned out I needed to add gdm-smartcard service to the list of services

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting