Part of the fleetcommander project is a FreeIPA plugin to add/update/delete "profiles" in JSON format in FreeIPA and client side to retrieve it (and dbus interface to query the data; put possibly only dbus interface).
CCM could use this method for linux freeipa managed hosts to retrieve profiles safely.
Also, it looks like it comes with rules to control who can update which profiles.