What were you trying to do that didn't work?

During ipa-server-install validation is done to ensure that the token is visible and that the token PIN works. This is to catch errors early.

This test is done as pkiuser:pkiuser

The problem is if pkiuser is a member of other groups that are necessary to access the HSM then this validation will fail (but installation would be ok).

What is the impact of this issue to you?

It causes server and/or replica installation failure