Ronald Wimmer via FreeIPA-users wrote:

Hi,

we found out that the behavior on our OL9 servers differs from the older ones. If a user should be able to use cron on a specific host (service in HBAC rule) this works on <OL8 servers. But on our OL9 servers an entry containing the respective user needs to exist in /etc/cron.allow on the server itself. Is this the desired behavior?

This isn't really an IPA question as we don't manage cron. Have you asked Oracle about this behavior change?

rob