There are ongoing RFEs like #4899 aiming for making FreeIPA operations like certificate requests easy to do and available for regular users. However, users normally do not have "ipa" command available as it is not installed by default and only via freeipa-admintools package.

That extra step can be avoided if ipa command is part of freeipa-client package. There is no notable package size cost, as all the libraries and packages are already in the freeipa-client package and freeipa-admintools only contain a short shim calling this code (and man page too).