I have a test freeipa server setup.
It is generally working fine, however I have found one major issue.
Even though a user only has 1 service enabled 'sshd' that user can su / su- to root.
I can confirm I have deleted the allow_all HBAC rule, and can confirm generally rules are working.
i.e if I remove sshd from allowed services the user cannot login.
Using ipa hbactest - sshd is granted, su is not