Aditya kamat via FreeIPA-users wrote:

I am configuring RBAC in my current FreeIPA setup. There is a requirement wherein each host can only belong to a particular host group. If a host is already a part of some host group, a particular role which I create should not be able to add it to any other host group.

Let me clarify this with an example:

Let us say host1 is a part of hostgroup1. There is a role which has modify access to hostgroup2 (i.e he can add or delete hosts from this group). Can I restrict this role from being able to add hosts which already belong to some other hostgroup?

That is going to be tricky to do. An IPA permission is basically a 389-ds ACI.

I'd start by manually trying to create such an ACI using targetfilter (see https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/ht...)

Without a specific permission for every hostgroup I'm not sure you can achieve this. I could be wrong.

rob