Description of problem:
Using ipa privilege-remove-permission to remove permissions from the privileges provided - throws an error that it is not a member of the privilege. But doing the same on privileges added by user is successful.

1> Remove the permission "add hbac rule" from privilege "HBAC Administrator"
# ipa privilege-remove-permission --permissions="add hbac rule"  "HBAC Administrator"
  Privilege name: HBAC Administrator
  Description: HBAC Administrator
  Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership
  Granting privilege to roles: IT Security Specialist
  Failed members: 
    permission: add hbac rule: This entry is not a member
-------------------------------
Number of permissions removed 0
-------------------------------


2> The error indicates this permission is not available for privilege, so then attempt to add the permission to privilege "HBAC Administrator"
# ipa privilege-add-permission --permissions="add hbac rule"  "HBAC Administrator"
  Privilege name: HBAC Administrator
  Description: HBAC Administrator
  Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership
  Granting privilege to roles: IT Security Specialist
  Failed members: 
    permission: add hbac rule: Type or value exists: 
-----------------------------
Number of permissions added 0
-----------------------------

This is the behaviour with all the privileges provided by IPA.  But for a privilege added by user, to which a permission is added, this is not the case:
1> Add a privilege
# ipa privilege-add "Test" --desc="Test"
----------------------
Added privilege "Test"
----------------------
  Privilege name: Test
  Description: Test

2> Add a permission to this privilege
# ipa privilege-add-permission --permissions="add hbac rule"  "Test" 
  Privilege name: Test
  Description: Test
  Permissions: add hbac rule
-----------------------------
Number of permissions added 1
-----------------------------

3> Remove this permission for this privilege 
# ipa privilege-remove-permission --permissions="add hbac rule"  "Test" 
  Privilege name: Test
  Description: Test
-------------------------------
Number of permissions removed 1
-------------------------------


Version-Release number of selected component (if applicable):
ipa-server-2.2.0-102.20120222T1126zgit64dd82f.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. Remove a permission from a IPA provided privilege (see more detailed steps above)

  
Actual results:
Throws an error - This entry is not a member

Expected results:
Be able to remove the permission from the privilege

Additional info: