Use Case:

User needs to self enrol himself with IPA in a secure way. He goes to a special page, hits create account, fills the data and hits submit. There should be some kind of the approval process, for example an email is sent to the designated admin or admins indicating that the account has been created. The admin then validates that this is the account that is allowed to be created.

May be a special OTP code can be used for registration. The flow can then be that the code is delivered to the user out of band, user then uses this code to register and his account creation is automatically approved.

There can be other schemes.

Feature should be available in UI and CLI. Feature should be turned off by default and require administrator to explicitly enable it.

For more information see: ​​https://www.redhat.com/archives/freeipa-users/2013-May/msg00040.html