Can this be configured via delegations?

IMO the solution would be for RHEV-M to create a host group in IdM per user and place hosts into that host group. It would also create a delegation allowing user to manage hosts only in the given group.

I suspect this all can be accomplished using existing software.
But IMO this is a good candidate for an integration effort.

We have the creatorsName attribute in LDAP so we'll know who made it, but I just wonder if this won't be precise enough for all use cases.

The visibility won't be possible until at earliest IPA 3.4 when the access control mechanism is changed not grant read by default to all authenticated users.

And note that this is 3 separate ACIs:

- grant ability to add a host (already exists)
- grant ability to modify host where creatorsName == bound user (needs to be written, should be trivial)
- grant ability to delete host where creatorsName == bound user (needs to be written, may be just as easy)

Note that deleting a host also means revoking any certificates for that host and deleting services for that host, so even simple things can be complex.

True, creatorsName attribute is the key to solve this RFE. I double checked the attribute and it should indeed work fine:

# ldapsearch -h localhost -D "cn=Directory Manager" -x -w Secret123 -b "fqdn=foo.example.com,cn=computers,cn=accounts,dc=example,dc=com" -s base creatorsName
...
# foo.example.com, computers, accounts, example.com
dn: fqdn=foo.example.com,cn=computers,cn=accounts,dc=example,dc=com
creatorsName: uid=admin,cn=users,cn=accounts,dc=example,dc=com

I will clone this request upstream.

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4054

The ticket was triaged by the upstream and scheduled to milestone for current milestone. However, the work has not started yet due to different prioritization. This request is thus not likely to be finished in next months. Additionally, when the request is finished, it is not planned to be added to RHEL-6.x product, but rather introduced in RHEL-7.x product (which does not harm, given that the permission would be replicated to all servers).

I am moving this Bugzilla to RHEL-7 product to narrow the expectations.

The bugzilla doesn't have high enough priority in comparison to other bugs/RFEs for 7.4. Moving to next release. Without sufficient justification it can be moved again later.

Thank you taking your time and submitting this request for Red Hat Enterprise Linux. The request was cloned to the upstream tracker a long time ago (see link to the upstream ticket above), but it was unfortunately not given priority either in the upstream project, nor in Red Hat Enterprise Linux.

Given that this request is not planned for a close release, it is highly unlikely it will be fixed in this major version of Red Hat Enterprise Linux. We are therefore closing the request as WONTFIX.

To request that Red Hat reconsiders the decision, please reopen the Bugzilla with the help of Red Hat Customer Service and provide additional business and/or technical details about it's importance to you. Please note that you can still track this request or even offer help in the referred upstream Pagure ticket to expedite the solution.