Can you be a bit more specific about what operations you are looking for? Please outline the use-cases for these so we can get a better idea of what you want.

For the rules I can only assume you mean Host-Based Access Control.

Hi @rcitten,
thanks for your quick response.

Use-Cases:

1. Members of a group should get the permission to redeploy (ipa-client-install) hosts from a certain hostgroup without being able to redeploy all hosts.

We can do this with a specific host with permissions host-allow-create-keytab and host-allow-retrieve-keytab set to the group and on another already connected host running ipa-getkeytab (after kinit for user in the specific group). We can only set those permissions for the keytabs to a specific host but not to a hostgroup so it has to be set to every host instead of a whole hostgroup. It would be even better if a user from the group could just use ipa-client-install without keytab (only user/password) to readd one of his hosts in his hostgroup.

1. Modify HBAC Rule to manage access to a specific hostgroup and hosts within the hostgroup (but not other hostgroups)

We want to give a team the right to specify who is allowed to login on machines within their responsibility (for example their own hostgroup). They also should be able to grant access to developers/QA/other (temporary and permanent) teams without needing a central management for freeipa.

1. Modify sudo rules on a specific hostgroups and hosts within the hostgroup (but not other hostgroups)

We want to give a team the right to enable/disable/add/remove sudo rules for their own machines/hostgroups without central management.
It would be nice if a team could also add own sudo rules to bea able to add them to only their own hosts.

1. Add Hosts to own hostgroup without being able to add hosts that are already in another hostgroup

We need a solution to add hosts to freeipa and set the correct hostgroup for those hosts.
We are thinking about a mechanism to add hosts to freeipa automatically when they appear in our CMDB.
Afterwards we want to enable teams to add hosts to freeipa and add them to their own hostgroup but only if the host was not already added to another hostgroup. (there is a managed by setting in hostgroups but with this you can add any host in freeipa to your managed hostgroup which we want to prevent as you get login/sudo permission on those hosts then).

For the redeploy case you should be able to target a hostgroup with a permission using memberof.

I'm not sure what you mean by central management. IPA is all about that.

I think most of this is possible using permissions by carefully setting the target and bind rules. It could just end up being a lot of permissions.

For the login ask I think this is possible now with HBAC rules.

You can use automember to add hosts using a name pattern automatically to hostgroups.

I'm just not sure that this is something that is widely desired.

Clarification for central management:

• We do not want a central help desk team managing login permissions

• The permissions and membership of groups should be manageable by the host owners themselves

Can you point out some documentation for using HBAC rules?