White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote:
I am considering the Host Based Access Control features to help
things in our infrastructure that cannot be ipa-clients - like network
hardware (switches, routers)
With the understanding that my servers do not run the DNS, can I create
such hosts to use in host groups and HBAC rules ?
You can create hosts that don't exist in DNS using --force on the
command-line. I'm pretty sure there is the equivalent in the WUI.
And sure you could add them to HBAC rules but enforcement happens on the
client and if the client isn't running sssd with the IPA backend...