It seems that the group members of IPA groups coming from AD through an external group are not lowercased:
{{{

mysqldev, groups, compat, ipa.example.com

dn: cn=mysqldev,cn=groups,cn=compat,dc=ipa,dc=example,dc=com
objectClass: posixGroup
objectClass: top
gidNumber: 1546600014
memberUid: Administrator@AD.EXAMPLE.COM
memberUid: tuser3
memberUid: viewtest
cn: mysqldev

domain users@ad.example.com, groups, compat, ipa.example.com

dn: cn=domain users@ad.example.com,cn=groups,cn=compat,dc=ipa,dc=example,dc=co
m
objectClass: posixGroup
objectClass: top
gidNumber: 198600513
memberUid: administrator@ad.example.com
cn: domain users@ad.example.com
}}}

Unfortunately, some client implementations like nss-pam-ldapd in rhel-6 are case-sensitive only, so administrator wouldn't be recognized as a member of mysqldev above.

Moreover, even ldapsearch seems to be case-sensitive, which was a bit strange to me:
{{{
ldapsearch -Y GSSAPI -H ldap://master.ipa.example.com -b cn=compat,dc=ipa,dc=example,dc=com memberUid=Administrator@ad.example.com
SASL/GSSAPI authentication started
SASL username: host/rhel6.ipa.example.com@IPA.EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.

extended LDIF

LDAPv3

base with scope subtree

filter: memberUid=Administrator@ad.example.com

requesting: ALL

search result

search: 4
result: 0 Success

numResponses: 1

[root@rhel6 ~]# ldapsearch -Y GSSAPI -H ldap://master.ipa.example.com -b cn=compat,dc=ipa,dc=example,dc=com memberUid=Administrator@AD.EXAMPLE.COM
SASL/GSSAPI authentication started
SASL username: host/rhel6.ipa.example.com@IPA.EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.

extended LDIF

LDAPv3

base with scope subtree

filter: memberUid=Administrator@AD.EXAMPLE.COM

requesting: ALL

ad_users, groups, compat, ipa.example.com

dn: cn=ad_users,cn=groups,cn=compat,dc=ipa,dc=example,dc=com
objectClass: posixGroup
objectClass: top
gidNumber: 1546600013
memberUid: Administrator@AD.EXAMPLE.COM
cn: ad_users

mysqldev, groups, compat, ipa.example.com

dn: cn=mysqldev,cn=groups,cn=compat,dc=ipa,dc=example,dc=com
objectClass: posixGroup
objectClass: top
gidNumber: 1546600014
memberUid: Administrator@AD.EXAMPLE.COM
memberUid: tuser3
memberUid: viewtest
cn: mysqldev

search result

search: 4
result: 0 Success

numResponses: 3

numEntries: 2

}}}

I hope this is not another oddity of my setup, but it would be nice to normalize the group names for AD users in IPA groups as well.