Andrew Meyer via FreeIPA-users wrote:
> I have been doing a lot of research on trying to get host groups to work
> with sudoers policies. However I'm finding that this can't be done and
> the only achieved by using netgroups. Is this true? I just would
> like some validation/confirmation before I go to far down the rabbit hole.
A hostgroup automatically creates a netgroup of the same name. Lookups
are done on the end system as a netgroup so you need to be sure that the
NIS domainname is set (should be done automatically by ipa-client-install).