On ti, 24 heinä 2018, Peter Tselios via FreeIPA-users wrote:
Thank you for your answer Alexander.
To be honest, I am not sure I liked the Katello/Satellite solution but
from your answer I understand that the intention is to use IPA users
for IPA operations, correct?
That's how it was designed in the first place so
the rest of IPA stack
assumes it. For pure IPA API access services are OK as long as you are
able to assign them privileges to do so (in 4.7.0 and later).
For anything that requires HBAC checks, you have to deal with POSIX
context right now and thus these actors have to be POSIX users/groups.
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland