Thanks again Rob for the help, the below permission is now working properly.
$ ipa permission-show test --all --raw dn: cn=test,cn=permissions,cn=pbac,dc=ipa,dc=example,dc=com cn: test ipapermright: all ipapermincludedattr: ipatokentotptimestep ipapermincludedattr: ipatokenotpalgorithm ipapermincludedattr: ipatokentotpwatermark ipapermincludedattr: ipatokenowner ipapermincludedattr: ipatokenotpdigits ipapermincludedattr: ipatokenuniqueid ipapermincludedattr: ipatokentotpclockoffset ipapermincludedattr: ipatokenotpkey ipapermincludedattr: cn ipapermincludedattr: ipatokenhotpsyncwindow ipapermincludedattr: ipatokenhotpauthwindow ipapermincludedattr: ipatokentotpsyncwindow ipapermincludedattr: ipatokentotpauthwindow ipapermincludedattr: objectclass ipapermbindruletype: permission ipapermlocation: dc=ipa,dc=example,dc=com ipapermtargetfilter: (objectclass=ipatoken) ipapermissiontype: SYSTEM ipapermissiontype: V2 aci: (targetattr = "cn || ipatokenhotpauthwindow || ipatokenhotpsyncwindow || ipatokenotpalgorithm || ipatokenotpdigits || ipatokenotpkey || ipatokenowner || ipatokentotpauthwindow || ipatokentotpclockoffset || ipatokentotpsyncwindow || ipatokentotptimestep || ipatokentotpwatermark || ipatokenuniqueid || objectclass")(targetfilter = "(objectclass=ipatoken)")(version 3.0;acl "permission:test";allow (all) groupdn = "ldap:///cn=test,cn=permissions,cn=pbac,dc=ipa,dc=example,dc=com";) objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2