[Freeipa-users] Restrict access to certain hosts

[Ashay Humane]

Hi List,

Does FreeIPA have a feature to restrict users to certain hosts/hostgroups?
If so, can this policy be fine grained?

For example, if hostgroup1 contains host1, host2, host3, can we say:
"Allow user1 to access all hosts in hostgroup1, except host2".

Thanks,
Ashay