Description of problem:
FreeIPA does not contain privilege to promote host into replicas.

When I tried to create role with privileges:

• Host Enrollment
• Replication Administrators
• Hostgroup Administrators

the host enrollment work fine but when ipa-replica-install command was used it fails with
Insufficient 'write' privilege to the 'member' attribute of entry 'cn=ipaservers,cn=hostgroups,cn=accounts,dc=example,dc=test'.

I think it is caused by:
"Extra target filter: (!(cn=ipaservers))"
in Permission:
"System: Modify Hostgroup Membership"

User Story:
As an Administrator I would not like to use the admin account/password every time I promote IPA client to replica or the other way. It would be good to have other user with privilege to do, so I am not forced to use Administrator account/password even in automated process.