Hi List, Does FreeIPA have a feature to restrict users to certain hosts/hostgroups? If so, can this policy be fine grained? For example, if hostgroup1 contains host1, host2, host3, can we say: "Allow user1 to access all hosts in hostgroup1, except host2". Thanks, Ashay