DESCRIPTION:

At the time of writing, the following bugzilla has been closed: #872671
AD users are indeed able to login to IPA now, but they're unable to do pretty
much anything.

AD users (users and admins) can see only their self-service page after
login to IPA WebUI. The admin view of IPA WebUI for AD admins is not
supported right now.
You can only modify the ID view settings and add ssh-keys and/or certificates
to your own account.

This ends up being pretty much useless as it doesn't allow managing roles
correctly in an integrated environment and strongly limits administration
capabilities.