Testing FreeIPA HBAC rules with hbactest
Checking FreeIPA access rules before enforcing them: ipa hbactest for user, host and service combinations, replacing allow_all safely, and keeping test cases for audits.
FreeIPA access control and delegation
Deciding who can log in, what they become and who may administer what in FreeIPA, beyond basic HBAC and sudo rules.
FreeIPA SELinux user maps
Confining users by host with FreeIPA SELinux user maps: linking maps to HBAC rules, staff_u and other SELinux users, sudo SELinux options, and testing confinement.
FreeIPA role-based access control for administrators
Delegating FreeIPA administration with roles, privileges and permissions: helpdesk password resets, host enrollment roles, limiting full admins, and reviewing delegations.
FreeIPA member managers for delegated group management
Letting team leads manage membership of their own user and host groups in FreeIPA without admin rights: member managers, what they can and cannot change, and audit of changes.
FreeIPA automember rules
Placing users and hosts into groups automatically in FreeIPA with automember rules based on attributes, default groups, rebuilding membership, and avoiding rules that grant access by accident.
FreeIPA password policies per group
Setting different password lifetimes, lengths, history and lockout settings for admins, service accounts and staff with FreeIPA group password policies and priorities.
