ipa role-show "User Administrator" --all --raw

ipa group-add enrolladm --desc "LDAP authentication for services" --nonposix
ipa role-add-member "User Administrator" --groups=enrolladm

echo "senha" | ipa user-add webadm --first=Web --last=Administrator --title="Enroll WebService" --password
ipa user-mod --shell=/bin/false webadm

ipa group-remove-member --users=webadm ipausers
ipa group-add-member enrolladm --users=webadm

kinit webadm
ipa user-show webadm --all

ipa user-del webadm
ipa group-del enrolladm