# How to control access with sudo and FreeIPA **URL:** \ **Category:** Ansible Project\ **Created:** [January 23, 2017, 1:50pm UTC](https://forum.ansible.com/t/how-to-control-access-with-sudo-and-freeipa/23531 "2017-01-23T13:50:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Rodrigo\_B\_Brasil](https://avatars.discourse-cdn.com/v4/letter/r/3da27b/32.png) [@Rodrigo\_B\_Brasil](https://forum.ansible.com/u/Rodrigo_B_Brasil)\ **Post date:** [January 23, 2017, 1:50pm UTC](https://forum.ansible.com/t/how-to-control-access-with-sudo-and-freeipa/23531/1 "2017-01-23T13:50:32Z")
Hello all! I’m trying to establish some access control when non-administrative user were running playbooks with Ansible. All the sudo rules are inherited from FreeIPA and now my only option is to create a sudo rule that enables **ALL** commands to an specific user to run some playbook on some host. This is, definitely, not the best practice, as with the same user could login into the host and execute any other command, and not **ONLY** those on my playbook on the master branch of my Git server. I’m sure that there is some another more elegant and secure way to grant some temporary administrative privileges on hosts to some user. Maybe working with the new ipa\_sudorule or something? Do you guys have some example to introduce me? s, Rodrigo B Brasil ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [February 10, 2017, 3:33am UTC](https://forum.ansible.com/t/how-to-control-access-with-sudo-and-freeipa/23531/2 "2017-02-10T03:33:00Z")
This is one of the things that the Ansible Tower server provides, full RBAC while using a shared user. Ansible itself does not have this built in, though there are many ways to enforce this using other tools to execute it. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [February 10, 2017, 8:01am UTC](https://forum.ansible.com/t/how-to-control-access-with-sudo-and-freeipa/23531/3 "2017-02-10T08:01:07Z")
Out of interest, which are those? Johannes ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [February 10, 2017, 2:16pm UTC](https://forum.ansible.com/t/how-to-control-access-with-sudo-and-freeipa/23531/4 "2017-02-10T14:16:45Z")
My favorites are cron, at and incron combined with unix ACLs and groups to restrict the different keys to each environment. But any job scheduler should work, you just need to make sure it meets your requirements, Tower just happens to pay my salary.