Potential API change for FreeIPA plugin writers

[Alexander Bokovoy]

Hi,

as you have probably noticed in a thread we had with Leo on
freeipa-users@ about FreeIPA plugin development, we hadn't had
consistency in handling boolean types between LDAP and IPA Python API
level. A change is coming that would make 'native' boolean types used in
both worlds. If your plugins rely on Bool() parameter handling in
FreeIPA, your code might be affected. If your scripts using output of
IPA API rely on case-sensitive output, you might need to adjust your
code.

If not, you can skip this email.

Pull request https://github.com/freeipa/freeipa/pull/6294 turns handling
of boolean types to be native to each side:

  - in LDAP, TRUE and FALSE strings used to represent the values
  - in Python, native True and False constants of bool type will be used
    to represent an LDAP boolean.

Prior to PR#6294, when an LDAP attribute with a boolean syntax was read
from LDAP, its representation in IPA Python code was either 'TRUE'
or 'FALSE' string. This created a bit of inconvenience:

  - Python code had to explicitly compare a value to 'TRUE' or 'FALSE',
  - Web UI JavaScript code had to use a radio-box where a simple checkbox
    would be enough
  - JavaScript plugin code would need to handle all types of 'TRUE',
    'FALSE', 1, 0, true, false, none in every place where a boolean type
    would be enough

After PR#6294 is merged, IPA Python code will use Python bool type.

JSON-RPC response to an IPA API command request would produce a simple
'true' or 'false' instead of ["TRUE"] or ["FALSE"]
elements. This means,
for example, that in the following command

   ipa dnszone-show ipa.test

instead of 
             "idnsallowdynupdate": [
                 "TRUE"
             ],
   
one would get
             "idnsallowdynupdate": [
                 true
             ],

and the output of 'ipa dnszone-show ipa.test' would have 'True' instead
of 'TRUE' (and False instead of 'FALSE'):

$ ipa dnszone-show ipa.test
   Zone name: ipa.test.
   Active zone: True
   Authoritative nameserver: idm.ipa.test.
   Administrator e-mail address: hostmaster.ipa.test.
   SOA serial: 1654159048
   SOA refresh: 3600
   SOA retry: 900
   SOA expire: 1209600
   SOA minimum: 3600
   BIND update policy: grant IPA.TEST krb5-self * A; grant IPA.TEST krb5-self * AAAA;
grant IPA.TEST krb5-self * SSHFP;
   Dynamic update: True
   Allow query: any;
   Allow transfer: none;

If your scripts rely on the case-sensitive output, you'd need to fix
them. IPA tools already able to handle the changes so they are
backward-compatible.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland