We augmented our Host enrollment role with permissions to create host objects. This is because we've encapsulated the function in our configuration management to enroll existing systems into IPA.
For more modern orchestration one could use OTP enrollment and teach the orchestrator to create a host object with a different account.
The Host administrator role has far more permissions, including deleting hosts.
I can look up the exact permissions for you if you want.
Verzonden vanaf mijn Samsung-apparaat
-------- Oorspronkelijk bericht --------
Van: Alexander Bokovoy via FreeIPA-users <freeipa-users@lists.fedorahosted.org>
Datum: 04-06-17 17:55 (GMT+01:00)
Aan: FreeIPA users list <freeipa-users@lists.fedorahosted.org>
Cc: Ronald Wimmer <ronaldw@ronzo.at>, Alexander Bokovoy <abokovoy@redhat.com>
Onderwerp: [Freeipa-users] Re: Privileges needed for ipa-client-install