Issue

Need to implement SUDO- and SSH- Host Based Access Control (HBAC) on RHEL 6, based on User-/Host-Groups(Linux, DB, SAP, ...).
A LDAP infrastructure is available with eDirectory. Unfortunately freeIPA is not an option.

SUDO HBAC
this works

For example:
- LDAP
sudoHost: +dbhosts
sudoUser: %dbadmins
...

• SSSD
  sudo_provider = ldap
  ldap_sudo_search_base = ou=SUDOers,...
  ldap_netgroup_search_base = ou=hosts,...

SSH HBAC
According this article:

SSSD Host Based Access Control using the LDAP host attribute and pam_check_host_attr
https://access.redhat.com/solutions/77543

The use of the 'host' attribute works fine with SSSD.

Is it also possible to specify a 'host group' instead of one 'host' entry for each FQDN and each user?

Need to keep all dynamical stuff (Host-groups, User-groups, Sudo-Roles, ...) on the LDAP-Server
and use the same sssd.conf and same sshd_config for all RHEL Machines, regardless of the (User-/Host-) Group they belong to.
So in this scenario 'AllowGroups' in sshd_config would not be an option.