diff --git a/roles/ipa/client/templates/fedora-nss-ignore.conf.j2 b/roles/ipa/client/templates/fedora-nss-ignore.conf.j2
index 784e4033b3..b83c765706 100644
--- a/roles/ipa/client/templates/fedora-nss-ignore.conf.j2
+++ b/roles/ipa/client/templates/fedora-nss-ignore.conf.j2
@@ -1,7 +1,7 @@
 # There are a bunch of users we want to prefer the local version instead of the ipa/ldap version.
 # But in at least one case, there is a real user ('mock') that we want to exclude on most machines,
 # but not on people and ipsilon to allow them access to their people space and be able to login to things.
-{% if inventory_hostname in groups['people','ipsilon','ipsilon_stg'] %}
+{% if inventory_hostname in groups['people'] or inventory_hostname in groups['ipsilon'] or inventory_hostname in groups['ipsilon_stg'] %}
 ## This file contains users who are in ipa to stop people from
 ## creating restricted accounts but we want to make sure the id in
 ## /etc/passwd and /etc/group are used.