EXTENSIONS

Manage FreeIPA user & host groups over the JSON-RPC API: snapshot the inventory, generic user-group CRUD (groupShow/groupAdd/groupMod/groupDel) plus a desired-state groupSync reconcile, ensure the FreeRADIUS radius-vlan-<id> group pair, and add/remove members — idempotent and auditable, with a confirm-guarded delete.

Issue, inspect, and revoke X.509 certificates for any FreeIPA principal (user/host/service) over the JSON-RPC API, with optional in-model RSA/EC keygen and vaulted private keys.

Manage FreeIPA sudo, HBAC, RBAC, privilege, and CA-ACL policy over the JSON-RPC API: find/show read-only snapshots plus idempotent ensureSudoRule/ensureHbacRule/ensureRole/ensurePrivilege/ensureCaAcl, fan-out member/option/privilege/permission/certprofile methods, enable/disable toggles, read-only privilege/permission/CA-ACL discovery, and confirm-guarded deletes, each mutation with an audit trail.

Manage FreeIPA DNS over the JSON-RPC API: zoneFind/zoneShow/recordFind read-only snapshots plus idempotent ensureZone/ensureForwardZone and a fan-out ensureRecords (add a list of records in one call), with confirm-guarded zoneDel/recordDel — each write carrying an audit trail. ensureRecords records partial applies honestly.

Manage FreeIPA hosts over the JSON-RPC API: find/show read-only snapshots plus add/mod/del/disable writes and a desired-state sync reconcile, each with an audit trail and a confirm-guarded delete. add random:true vaults the one-time enrollment password; add/del take an optional idempotent flag.

Manage FreeIPA users over the JSON-RPC API: find/show read-only snapshots plus add/mod/del/setEnabled writes and a desired-state sync reconcile, each with an audit trail and a confirm-guarded delete. add/del take an optional idempotent flag.

Read-only FreeIPA domain inspection over the JSON-RPC API: realm/config, server inventory, and replication topology, plus a markdown + Mermaid summary report.