Thank you kindly Alexander! I confirm this set of privs and permissions did allow me to
issue a user key and cert via certmonger.
It also helped me understand a little better the structure of IPA permissions from the
point of view of someone who's done a little bit of LDAP backend work. Examples are
useful. :)
-- Pat