Request for enhancement

To begin with: THIS IS NOT MULTI-TENANCY.

A contributor has proposed a way to delegate control over a set of hosts.

It is desirable to be able to delegate management control over a set of IPA hosts. This management would consist of a number of standard services like HBAC rules, SUDO rules and more.

An IPA host has an optional attribute visible as Class, the LDAP attribute userClass. This attribute has been available for hosts since IPA v3.2 (2013) as part of https://www.freeipa.org/page/V3/Integration_with_provisioning_systems.html . This value will be used to mark a host as part of a namespace. A host may only be a member of a single namespace.

An administrative group for each "namespace" will be created and granted access via a series of new ACIs that allow adding/modifying/removing entries related to the namespace.