IPA 4.9.10+ handles LDAP boolean values correctly, and the comparison should be executed with the values itself, instead of a string representation.
