1. Add a permission for a dns zone.
2. then check the zone managedBy attr.

3. Shows up with bad label - Failed managedby

   ipa dnszone-show one.testrelm.com --all

   dn: idnsname=one.testrelm.com,cn=dns,dc=testrelm,dc=com
   Zone name: one.testrelm.com
   Authoritative nameserver: qe-blade-04.testrelm.com.
   Administrator e-mail address: hostmaster.one.testrelm.com.
   SOA serial: 1342635223
   SOA refresh: 3600
   SOA retry: 900
   SOA expire: 1209600
   SOA minimum: 3600
   BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
   Active zone: TRUE
   Dynamic update: FALSE
   Allow query: any;
   Allow transfer: none;
   Failed managedby: cn=manage dns zone one.testrelm.com,cn=permissions,cn=pbac,dc=testrelm,dc=com
   nsrecord: qe-blade-04.testrelm.com.
   objectclass: top, idnsrecord, idnszone, ipadnszone

   ipa dnszone-show one.testrelm.com --all --raw

   <snip>
   managedby: cn=manage dns zone one.testrelm.com,cn=permissions,cn=pbac,dc=testrelm,dc=com
   <snip>

Version used:
freeipa-server-2.99.0-0.20120719T0441Zgit78810f9.fc17.x86_64