formean-installer should set appropriate selinux booleans for IPA authentication
The formean-installer should set appropriate selinux booleans based on settings, for example, if IPA authentication is "enabled" it should set the following:
setsebool -P allow_httpd_mod_auth_pam on
setsebool -P httpd_dbus_sssd on
(via puppet modules of course)
This is already documented http://theforeman.org/manuals/1.10/index.html#5.7.3KerberosSingleSign-On ... but the installer should take care of it.