Check that Search size limit is greater then the number of rules

[NegaScout]

if Search size limit is lower, then number of hbac rules, sssd/hbac test will fail, even if the access is allowed via existing rule

This possibly can apply to more objects?

[rcritten]

Please clarify what you are reporting.

I assume you are referring to the hbactest command?

That if the number of hbac rules exceeds the search size limit then the hbactest may incorrectly fail?

[NegaScout]

Yes, sorry.

If search size limit is lower then the number of hbac rules, the hbactest command exceeds search limit and yields incorrect 'Access Denied', as you have infered