Freeipa/policy

Snapshot sudo rules matching an optional search criteria (read-only).

Snapshot a single sudo rule by name (read-only).

Idempotently ensure a sudo rule exists (sudorule_add). Swallows DuplicateEntry and re-reads via sudorule_show, so re-runs are safe. sudoorder is a first-class arg because sudo evaluation is last-match-wins — order matters. Writes the sudo rule state on success; audits both paths.

Add a sudo option to a rule (sudorule_add_option), e.g. `!authenticate` for passwordless sudo. Writes the updated sudo rule state on success; audits both paths.

Add users and/or user groups to a sudo rule in one call (sudorule_add_user). Fan-out: pass lists of users and groups. Surfaces IPA's `failed` structure in the audit response; writes the updated sudo rule state on success.

Add hosts and/or host groups to a sudo rule in one call (sudorule_add_host). Fan-out: pass lists of hosts and hostgroups. Surfaces IPA's `failed` structure in the audit response; writes the updated sudo rule state on success.

Add allowed commands and/or command groups to a sudo rule in one call (sudorule_add_allow_command). Fan-out: pass lists of sudocmds and sudocmdgroups. Surfaces IPA's `failed` structure in the audit response; writes the updated sudo rule state on success.

Enable or disable a sudo rule (sudorule_enable / sudorule_disable). Writes the updated sudo rule state on success; audits both paths.

Delete a sudo rule (sudorule_del). Requires confirm:true; audits both paths.

Snapshot HBAC rules matching an optional search criteria (read-only).

Snapshot a single HBAC rule by name (read-only).

Idempotently ensure an HBAC rule exists (hbacrule_add). Swallows DuplicateEntry and re-reads via hbacrule_show, so re-runs are safe. Writes the HBAC rule state on success; audits both paths.

Add users and/or user groups to an HBAC rule in one call (hbacrule_add_user). Fan-out: pass lists of users and groups. Surfaces IPA's `failed` structure in the audit response; writes the updated HBAC rule state on success.

Add hosts and/or host groups to an HBAC rule in one call (hbacrule_add_host). Fan-out: pass lists of hosts and hostgroups. Surfaces IPA's `failed` structure in the audit response; writes the updated HBAC rule state on success.

Add HBAC services and/or service groups to an HBAC rule in one call (hbacrule_add_service). Fan-out: pass lists of hbacsvcs and hbacsvcgroups. Surfaces IPA's `failed` structure in the audit response; writes the updated HBAC rule state on success.

Enable or disable an HBAC rule (hbacrule_enable / hbacrule_disable). Writes the updated HBAC rule state on success; audits both paths.

Delete an HBAC rule (hbacrule_del). Requires confirm:true; audits both paths.

Snapshot roles matching an optional search criteria (read-only).

Snapshot a single role by name (read-only).

Idempotently ensure a role exists (role_add). Swallows DuplicateEntry and re-reads via role_show, so re-runs are safe. Writes the role state on success; audits both paths. NOTE: role/privilege mutation is privilege-escalation sensitive — the scoped service account is deliberately NOT granted Delegation Administrator, so this operates only within the rights the operator already holds.

Add privileges to a role in one call (role_add_privilege). Fan-out: pass a list of privileges. Surfaces IPA's `failed` structure in the audit response; writes the updated role state on success. NOTE: privilege-escalation sensitive — bounded by the operator's own rights (no Delegation Administrator on the scoped account).

Add users and/or user groups to a role in one call (role_add_member). Fan-out: pass lists of users and groups. Surfaces IPA's `failed` structure in the audit response; writes the updated role state on success.

Snapshot privileges matching an optional search criteria (read-only). Useful for discovering the privilege names to feed roleAddPrivilege.

Snapshot permissions matching an optional search criteria (read-only). Useful for discovering the permission names bundled into privileges.

Delete a role (role_del). Requires confirm:true; audits both paths. NOTE: role deletion is privilege-escalation sensitive and admin-scoped by design.

Snapshot a single privilege by name, including its bundled permissions (read-only).

Idempotently ensure a privilege exists (privilege_add). Swallows DuplicateEntry and re-reads via privilege_show, so re-runs are safe. Writes the privilege state on success; audits both paths. NOTE: privilege mutation is privilege-escalation sensitive and admin/break-glass scoped — the scoped service account is deliberately NOT granted Delegation Administrator, so this operates only within the rights the operator already holds.

Add permissions to a privilege in one call (privilege_add_permission). Fan-out: pass a list of permissions. Surfaces IPA's `completed`/`failed`/`result` structure in the audit response; writes the updated privilege state on success. NOTE: privilege mutation is privilege-escalation sensitive and admin/break-glass scoped — bounded by the operator's own rights (no Delegation Administrator on the scoped service account).

Delete a privilege (privilege_del). Requires confirm:true; audits both paths. NOTE: privilege deletion is privilege-escalation sensitive and admin/break-glass scoped by design (the scoped service account is deliberately NOT granted Delegation Administrator).

Snapshot CA ACLs matching an optional search criteria (read-only).

Snapshot a single CA ACL by name (read-only).

Idempotently ensure a CA ACL exists (caacl_add). Swallows DuplicateEntry and re-reads via caacl_show, so re-runs are safe. Writes the CA ACL state on success; audits both paths. `userCategory:'all'` and the other attrs are applied on CREATE only — like ensureRole/ensureSudoRule, a pre-existing divergent ACL is re-read but NOT reconciled on the duplicate path. NOTE: CA-ACL mutation is privilege-escalation sensitive and admin/break-glass scoped — a CA ACL governs who may obtain certificates; the s

Add certificate profiles to a CA ACL in one call (caacl_add_profile; the IPA CLI is `caacl-add-profile --certprofiles=`). Fan-out: pass a list of certprofiles (IPA option `certprofile`). Surfaces IPA's `completed`/`failed`/`result` structure in the audit response; writes the updated CA ACL state on success. NOTE: CA-ACL mutation is privilege-escalation sensitive and admin/break-glass scoped (no Delegation Administrator on the scoped service account).

Add users and/or user groups to a CA ACL in one call (caacl_add_user). Fan-out: pass lists of users and groups (IPA options `user`/`group`). Surfaces IPA's `completed`/`failed`/`result` structure in the audit response; writes the updated CA ACL state on success. NOTE: CA-ACL mutation is privilege-escalation sensitive and admin/break-glass scoped (no Delegation Administrator on the scoped service account).

Enable or disable a CA ACL (caacl_enable / caacl_disable). Writes the updated CA ACL state on success; audits both paths. NOTE: CA-ACL mutation is privilege-escalation sensitive and admin/break-glass scoped (no Delegation Administrator on the scoped service account).

Delete a CA ACL (caacl_del). Requires confirm:true; audits both paths. NOTE: CA-ACL deletion is privilege-escalation sensitive and admin/break-glass scoped by design (the scoped service account is deliberately NOT granted Delegation Administrator).