The authentication client's comparison behavior is more or less banjaxed. It needs to be fixed, starting probably with killing off multi-valued configuration items.