diff --git a/ipaserver/plugins/hbacrule.py b/ipaserver/plugins/hbacrule.py
index 2601ebe03..95bef1eae 100644
--- a/ipaserver/plugins/hbacrule.py
+++ b/ipaserver/plugins/hbacrule.py
@@ -317,7 +317,7 @@ class hbacrule_del(LDAPDelete):
 
     def pre_callback(self, ldap, dn, *keys, **options):
         assert isinstance(dn, DN)
-        kw = dict(seealso=keys[0])
+        kw = dict(seealso=str(dn), pkey_only=True)
         _entries = api.Command.selinuxusermap_find(None, **kw)
         if _entries['count']:
             raise errors.DependentEntry(key=keys[0], label=self.api.Object['selinuxusermap'].label_singular, dependent=_entries['result'][0]['cn'][0])
diff --git a/ipaserver/plugins/selinuxusermap.py b/ipaserver/plugins/selinuxusermap.py
index 1a3afb51f..999c253bc 100644
--- a/ipaserver/plugins/selinuxusermap.py
+++ b/ipaserver/plugins/selinuxusermap.py
@@ -454,12 +454,20 @@ class selinuxusermap_find(LDAPSearch):
         if options.get('seealso'):
             hbacrule = options['seealso']
 
+            # If a complete DN is passed we can skip calling hbacrule-show
             try:
-                hbac = api.Command['hbacrule_show'](hbacrule,
-all=True)['result']
-                dn = hbac['dn']
-            except errors.NotFound:
-                return dict(count=0, result=[], truncated=False)
+                tmpdn = DN(hbacrule)
+            except ValueError:
+                tmpdn = DN()
+            if DN(api.env.container_hbac, api.env.basedn) not in tmpdn:
+                try:
+                    hbac = api.Command['hbacrule_show'](hbacrule,
+                                                        all=True)['result']
+                    dn = hbac['dn']
+                except errors.NotFound:
+                    return dict(count=0, result=[], truncated=False)
+            else:
+                dn = tmpdn
             options['seealso'] = dn
 
         return super(selinuxusermap_find, self).execute(*args, **options)