diff --git a/inventory/group_vars/fedocal b/inventory/group_vars/fedocal
index 5b9bf7194a..d0ac99c86c 100644
--- a/inventory/group_vars/fedocal
+++ b/inventory/group_vars/fedocal
@@ -17,6 +17,17 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.3.163.39 --dport 873 -j ACCEPT', '
 
 fas_client_groups: sysadmin-noc,sysadmin-web,sysadmin-veteran
 
+ipa_host_group: fedocal
+ipa_host_group_desc: Fedora calendaring service
+ipa_client_shell_groups:
+- sysadmin-noc
+- sysadmin-web
+- sysadmin-veteran
+ipa_client_sudo_groups:
+- sysadmin-noc
+- sysadmin-web
+- sysadmin-veteran
+
 freezes: false
 
 # These are consumed by a task in roles/fedmsg/base/main.yml
diff --git a/inventory/group_vars/torrent b/inventory/group_vars/torrent
index 36efa42484..2c6510ce58 100644
--- a/inventory/group_vars/torrent
+++ b/inventory/group_vars/torrent
@@ -8,6 +8,20 @@ tcp_ports: [ 53, 80, 443, 873, "6881:6999" ]
 udp_ports: [ 53 ]
 
 fas_client_groups: sysadmin-web,torrentadmin,sysadmin-noc,torrent-cc,fi-apprentice,sysadmin-veteran
+ipa_host_group: torrent
+ipa_host_group_desc: BitTorrent trackers
+ipa_client_shell_groups:
+- fi-apprentice
+- sysadmin-noc
+- sysadmin-veteran
+- sysadmin-web
+- torrent-cc
+- torrentadmin
+ipa_client_sudo_groups:
+- sysadmin-noc
+- sysadmin-veteran
+- sysadmin-web
+- torrentadmin
 
 nrpe_procs_warn: 300
 nrpe_procs_crit: 500
diff --git a/inventory/group_vars/unbound b/inventory/group_vars/unbound
index 3bac42cf1d..029f66fc6a 100644
--- a/inventory/group_vars/unbound
+++ b/inventory/group_vars/unbound
@@ -12,5 +12,12 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 209.132.184.0/24 --dport 53 -j ACCEPT
                 '-A INPUT -p udp -m udp -s 209.132.181.0/24 --dport 53 -j ACCEPT' ]
 
 fas_client_groups: sysadmin-dns
+ipa_host_group: unbound
+ipa_host_group_desc: Unbound caching DNS
+ipa_client_shell_groups:
+- sysadmin-dns
+ipa_client_sudo_groups:
+- sysadmin-dns
+
 freezes: false
 postfix_group: vpn