Potential API change for FreeIPA plugin writers

[Alexander Bokovoy]

Hi,

as you have probably noticed in a thread we had with Leo on
freeipa-users@ about FreeIPA plugin development, we hadn't had
consistency in handling boolean types between LDAP and IPA Python API
level. A change is coming that would make 'native' boolean types used in
both worlds. If your plugins rely on Bool() parameter handling in
FreeIPA, your code might be affected. If your scripts using output of
IPA API rely on case-sensitive output, you might need to adjust your
code.

If not, you can skip this email.

Pull request https://github.com/freeipa/freeipa/pull/6294 turns handling
of boolean types to be native to each side:

  - in LDAP, TRUE and FALSE strings used to represent the values
  - in Python, native True and False constants of bool type will be used
    to represent an LDAP boolean.

Prior to PR#6294, when an LDAP attribute with a boolean syntax was read
from LDAP, its representation in IPA Python code was either 'TRUE'
or 'FALSE' string. This created a bit of inconvenience:

  - Python code had to explicitly compare a value to 'TRUE' or 'FALSE',
  - Web UI JavaScript code had to use a radio-box where a simple checkbox
    would be enough
  - JavaScript plugin code would need to handle all types of 'TRUE',
    'FALSE', 1, 0, true, false, none in every place where a boolean type
    would be enough

After PR#6294 is merged, IPA Python code will use Python bool type.

JSON-RPC response to an IPA API command request would produce a simple
'true' or 'false' instead of ["TRUE"] or ["FALSE"]
elements. This means,
for example, that in the following command

   ipa dnszone-show ipa.test

instead of 
             "idnsallowdynupdate": [
                 "TRUE"
             ],
   
one would get
             "idnsallowdynupdate": [
                 true
             ],

and the output of 'ipa dnszone-show ipa.test' would have 'True' instead
of 'TRUE' (and False instead of 'FALSE'):

$ ipa dnszone-show ipa.test
   Zone name: ipa.test.
   Active zone: True
   Authoritative nameserver: idm.ipa.test.
   Administrator e-mail address: hostmaster.ipa.test.
   SOA serial: 1654159048
   SOA refresh: 3600
   SOA retry: 900
   SOA expire: 1209600
   SOA minimum: 3600
   BIND update policy: grant IPA.TEST krb5-self * A; grant IPA.TEST krb5-self * AAAA;
grant IPA.TEST krb5-self * SSHFP;
   Dynamic update: True
   Allow query: any;
   Allow transfer: none;

If your scripts rely on the case-sensitive output, you'd need to fix
them. IPA tools already able to handle the changes so they are
backward-compatible.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Leo O]

Hello Alexander,

I finally found the time to get some stuff done and created my ci/cd pipeline for the auto
build of freeipa with my postfix book plugin extension:
https://hub.docker.com/r/leonidaso/freeipa-server

According to https://github.com/freeipa/freeipa/pull/6304 it should be back ported into
4.9? So as I'm using the latest "rocky-8-4.9.8" docker image as base, should
it be already in there (with latest 4.9.8 I still have the same issue with booleans) or
where to find the fix? Unfortunately I don't see any newer rocky based docker images.


Regards
Leo

[Rob Crittenden]

Leo O via FreeIPA-users wrote:
>  Hello Alexander,
>  
>  I finally found the time to get some stuff done and created my ci/cd pipeline for the
> auto build of freeipa with my postfix book plugin extension:
>  https://hub.docker.com/r/leonidaso/freeipa-server
>  
>  According to https://github.com/freeipa/freeipa/pull/6304 it should be back ported into
> 4.9? So as I'm using the latest "rocky-8-4.9.8" docker image as base, should
> it be already in there (with latest 4.9.8 I still have the same issue with booleans) or
> where to find the fix? Unfortunately I don't see any newer rocky based docker images.
This fix is in upstream release 4.9.10.

rob

[Alexander Bokovoy]

On ma, 25 heinä 2022, Rob Crittenden via FreeIPA-users wrote:
> Leo O via FreeIPA-users wrote:
> > Hello Alexander,
> >
> > I finally found the time to get some stuff done and created my ci/cd
> > pipeline for the auto build of freeipa with my postfix book plugin
> > extension: https://hub.docker.com/r/leonidaso/freeipa-server
> >
> > According to https://github.com/freeipa/freeipa/pull/6304 it should
> > be back ported into 4.9? So as I'm using the latest "rocky-8-4.9.8"
> > docker image as base, should it be already in there (with latest
> > 4.9.8 I still have the same issue with booleans) or where to find the
> > fix? Unfortunately I don't see any newer rocky based docker images.
>
> This fix is in upstream release 4.9.10. 
Yes, it is available in Fedora already. RHEL 8 version is being formally
tested by QE right now. Once they are done and packages are part of RHEL
8 nightly composes, CentOS 8 Stream will be updated to include their
rebuilds. At that point RHEL downstream rebuilds will pick those up, I
guess.

Please note that in general there is no direct relationship between
upstream opensource project releases and downstream packages -- gaps in
release time between upstream and distributions are normal and
correspond to packaging and quality engineering work being done by the
distributions.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland