Use case:

SELinux user context needs to be assigned to the user when user logs into the system. It is very similar to HBAC except that it is a tag associated with the user-host combination instead of yes/no as in case of HBAC.

On one hand it makes sense to leverage the HBAC infrastructure the deployment might have so that the user-host relations defined in HBAC do not need to be redefined once again. On the other hand we can't assume that HBAC infrastructure is in place. In this case SELLnux rules should be definable independently.

Here is some idea how that can be done:

Let us forget about the HBAC for a moment and say we have to support SELinux objects in IPA.
So we will have following objects in LDAP:

SELinux Object:
- User (Pointer to identity represented by user or group - it is a multi value attribute so can point to users and groups)
- Host (Pointer to host identity represented by host or host group - it is a multi value attribute so can point to hosts and groups of hosts)
- SELinux user
- Priority
- Is default (means if not matched this is the default SELinux user to use)

The current HBAC object looks like this:
- User (Pointer to identity represented by user or group - it is a multi value attribute so can point to users and groups)
- Host (Pointer to host identity represented by host or host group - it is a multi value attribute so can point to hosts and groups of hosts)
- Service (Pointer to login service "sudo", "ssh", "telnet", "ftp" etc. or group of those - it is a multi value attribute as above).
- From Host (Pointer to host identity represented by host or host group or some external unmanaged host- it is a multi value attribute so can point to hosts and groups of hosts)
- Time (when the rule is applicable - was temporarily removed from HBAC)
- Allow/Deny

The SELinux user context is somewhat related to HBAC but only to allow rules. So to reduce management burden we should allow SELinux users to be defined as extension of the already existing HBAC rule. This would look like this:

SELinux Object
- User host definition
- Pointer to HBAC rule

   --or--

- Define those:
    - User (Pointer to identity represented by user or group - it is a multi value attribute so can point to users and groups)
    - Host (Pointer to host identity represented by host or host group - it is a multi value attribute so can point to hosts and groups of hosts)

- SELinux user
- Priority
- Is default (means if not matched this is the default SELinux user to use)

If you want to use just HBAC or just SELinux you can, but you can also link then together if you want and leverage User - Host definition specified in the allow rule in the SELinux rule.
On SSSD side these objects will be cached in the same way as defined by LDAP on the server side. And when the SSSD needs to say yes/no it will consult just HBAC. If it needs to do just SELinux it will need to cache SELinux users. If an SELInux rule refers to an HBAC rule it will be
pulled too even if the SSSD is not configured to enforce or check HBAC.

The corresponding freeipa ticket is:
https://fedorahosted.org/freeipa/ticket/755