sssd_be goes to 99% CPU with significant login delays with large hbac hostgroups

Issue

Following a restart of sssd and a subsequent login attempt, the sssd_be process spikes at 99% cpu, and a delay of 30-60 seconds can be experienced.

This occurs during an hbac decision when there are particularly large hostgroups with many many hosts.
Subsequent logins seem fine until whichever cache is effected needs to be renewed again, which in turn reproduces the long delay.

The bug affects both RHEL5 & RHEL6 version of SSSD.