Call out a f-ctl prereq explicitly

Author: aneta-petrova

guides/common/modules/proc_configuring-host-based-access-control-for-freeipa-users-logging-in-to-project.adoc

@@ -12,6 +12,11 @@ By configuring a HBAC rule in the {FreeIPA} domain, you can ensure {Project} doe
 
 .Prerequisites
 * {FreeIPA} user account with privileges to configure HBAC rules
+ifdef::foremanctl[]
+* The external authentication source has been enabled on your {ProjectServer} by using the `foremanctl deploy --external-authentication` command.
+For more information, see xref:configuring-the-freeipa-authentication-source-on-projectserver_{context}[].
+// The `foremanctl deploy --external-authentication-pam-service foreman-prod` command used below expects that `foremanctl deploy --external-authentication` has already been run.
+endif::[]
 
 .Procedure
 . On the {FreeIPA} server, configure HBAC control.