diff --git a/README-hbacsvc.md b/README-hbacsvc.md
index 7203e54971c47ddda82fa0b0258712fc1e2ded5e..49644b8fb7eecdd416d83dc94e1d09cceb3fb2ad 100644
--- a/README-hbacsvc.md
+++ b/README-hbacsvc.md
@@ -98,6 +98,7 @@ Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
+`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
 `name` \| `cn` \| `service` | The list of hbacsvc name strings. | no
 `description` | The hbacsvc description string. | no
 `state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | no
diff --git a/tests/hbacsvc/test_hbacsvc.yml b/tests/hbacsvc/test_hbacsvc.yml
index c91cf39b0fba8b0e6952ccf024bf9b13dc9c89e6..135fd11fa9edcbd87065c07e703ff65dd1e7e9cd 100644
--- a/tests/hbacsvc/test_hbacsvc.yml
+++ b/tests/hbacsvc/test_hbacsvc.yml
@@ -1,6 +1,6 @@
 ---
 - name: Test hbacsvc
-  hosts: ipaserver
+  hosts: "{{ ipa_test_host | default('ipaserver') }}"
   become: true
   gather_facts: false
 
@@ -8,12 +8,14 @@
   - name: Ensure HBAC Service for http is absent
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: http,tftp
       state: absent
 
   - name: Ensure HBAC Service for http is present
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: http
     register: result
     failed_when: not result.changed or result.failed
@@ -21,6 +23,7 @@
   - name: Ensure HBAC Service for http is present again
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: http
     register: result
     failed_when: result.changed or result.failed
@@ -28,6 +31,7 @@
   - name: Ensure HBAC Service for tftp is present
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: tftp
       description: TFTP service
     register: result
@@ -36,6 +40,7 @@
   - name: Ensure HBAC Service for tftp is present again
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: tftp
       description: TFTP service
     register: result
@@ -44,6 +49,7 @@
   - name: Ensure HBAC Services for http and tftp are absent
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: http,tftp
       state: absent
     register: result
@@ -52,6 +58,7 @@
   - name: Ensure HBAC Services for http and tftp are absent again
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: http,tftp
       state: absent
     register: result
diff --git a/tests/hbacsvc/test_hbacsvc_client_context.yml b/tests/hbacsvc/test_hbacsvc_client_context.yml
new file mode 100644
index 0000000000000000000000000000000000000000..161fa0221ec6b31b760d0a9a2036a19967c4ab7c
--- /dev/null
+++ b/tests/hbacsvc/test_hbacsvc_client_context.yml
@@ -0,0 +1,37 @@
+---
+- name: Test hbacsvc
+  hosts: ipaclients, ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+  - name: Include FreeIPA facts.
+    include_tasks: ../env_freeipa_facts.yml
+
+  # Test will only be executed if host is not a server.
+  - name: Execute with server context in the client.
+    ipahbacsvc:
+      ipaadmin_password: SomeADMINpassword
+      ipaapi_context: server
+      name: ThisShouldNotWork
+    register: result
+    failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
+    when: ipa_host_is_client
+
+# Import basic module tests, and execute with ipa_context set to 'client'.
+# If ipaclients is set, it will be executed using the client, if not,
+# ipaserver will be used.
+#
+# With this setup, tests can be executed against an IPA client, against
+# an IPA server using "client" context, and ensure that tests are executed
+# in upstream CI.
+
+- name: Test hbacsvc using client context, in client host.
+  import_playbook: test_hbacsvc.yml
+  when: groups['ipaclients']
+  vars:
+    ipa_test_host: ipaclients
+
+- name: Test hbacsvc using client context, in server host.
+  import_playbook: test_hbacsvc.yml
+  when: groups['ipaclients'] is not defined or not groups['ipaclients']