Bug 675284

Description of problem:
"Authorized service attribute has no matching rule, access denied" message gets logged in /var/log/secure even though there exists a valid rule to grant access to user and authentication succeeds.

Version-Release number of selected component (if applicable):
sssd-1.5.1-3.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. On DS add user (puser1) with objectclass authorizedServiceObject and authorizedService: sshd. 
2. Configure SSSD with ldap_access_order as authorized_service. See "Additional info" section for relevant sssd.conf
3. Restart sssd with clear cache.
4. Using ssh try authenticating as puser1.
  
Actual results:
Snipped /var/log/secure:
Feb  4 19:36:01 rhel6-1 sshd[1941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost  user=puser1
Feb  4 19:36:03 rhel6-1 sshd[1941]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=puser1
Feb  4 19:36:03 rhel6-1 sshd[1941]: pam_sss(sshd:account): system info: [Authorized service attribute has no matching rule, access denied]
Feb  4 19:36:03 rhel6-1 sshd[1941]: Accepted password for puser1 from 127.0.0.1 port 46390 ssh2
Feb  4 19:36:03 rhel6-1 sshd[1941]: pam_unix(sshd:session): session opened for user puser1 by (uid=0)

"Authorized service attribute has no matching rule, access denied" message gets logged in /var/log/secure even though there exists a valid rule for sshd service.

Expected results:
Should not print this message on successful requests.

Additional info:

Relevant section of sssd.conf:
[domain/default]
ldap_tls_reqcert = demand
auth_provider = ldap
ldap_schema = rfc2307
ldap_default_authtok_type = obfuscated_password
ldap_search_base = dc=example,dc=com
id_provider = ldap
ldap_id_use_start_tls = False
ldap_default_bind_dn = uid=puser1,ou=People,dc=example,dc=com
ldap_tls_cacert = /etc/openldap/cacerts/cacert.asc
debug_level = 9
ldap_uri = ldaps://sssdldap.redhat.com:636
enumerate = True
cache_credentials = True
ldap_default_authtok = AAAQAFFoJm/cBfbpU83dl5fe2wTdWeTPvLS8mfbDyZSN1AFK0tGwV6d0fJgr6lr33IYKK88yoZsASPUv20IUPtmCJZ4AAQIDAAA=
ldap_tls_cacertdir = /etc/openldap/cacerts
access_provider = ldap
ldap_access_order = authorized_service
ldap_user_authorized_service = authorizedService