FreeIPA Plugins not found

[Carlos Queen]

Hello everyone,

I want to change my email format and I searched out, I found an instruction that uses a
piece of python code in /usr/lib/python2.7/site-packages/ipalib/plugins/, problem is that
my ipa server version is 4.6.8 and API 2.237 and it has not the directory plugins. 

My question is: It is not possible to add plugins in this version? Is there any other way
to customize anything in freeipa?

I hope you guys help me, thanks in advance.

[Rob Crittenden]

Carlos Queen via FreeIPA-users wrote:
>  Hello everyone,
>  
>  I want to change my email format and I searched out, I found an instruction that uses a
> piece of python code in /usr/lib/python2.7/site-packages/ipalib/plugins/, problem is that
> my ipa server version is 4.6.8 and API 2.237 and it has not the directory plugins. 
>  
>  My question is: It is not possible to add plugins in this version? Is there any other way
> to customize anything in freeipa?
>  
>  I hope you guys help me, thanks in advance. 
You're trying to use code for a much older version. It still might work
though. The plugins were moved to
<python_dir>/site-packages/ipaserver/plugins

It would also help if you shared where you found the code and what
exactly you're trying to do.

rob

[José Luís]

Thanks for your answer Rob,

The code I quote is from  Alexander Bokovoy
<https://listman.redhat.com/archives/freeipa-users/2015-August/msg00078.ht...
.

Sorry, what you mean by "You're trying to use code for a much older
version"? Is there any other way more sophisticated?

If yes, let me know please, I'm a complete newbie in FreeIPA.

Thanks.

Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
escreveu no dia terça, 16/03/2021 à(s) 23:02:

>  Carlos Queen via FreeIPA-users wrote:
>  > Hello everyone,
>  >
>  > I want to change my email format and I searched out, I found an
>  instruction that uses a piece of python code in
>  /usr/lib/python2.7/site-packages/ipalib/plugins/, problem is that my ipa
>  server version is 4.6.8 and API 2.237 and it has not the directory plugins.
>  >
>  > My question is: It is not possible to add plugins in this version? Is
>  there any other way to customize anything in freeipa?
>  >
>  > I hope you guys help me, thanks in advance.
>
>  You're trying to use code for a much older version. It still might work
>  though. The plugins were moved to
>  <python_dir>/site-packages/ipaserver/plugins
>
>  It would also help if you shared where you found the code and what
>  exactly you're trying to do.
>
>  rob
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Rob Crittenden]

José Luís wrote:
>  Thanks for your answer Rob,
>  
>  The code I quote is from  Alexander Bokovoy
>  <https://listman.redhat.com/archives/freeipa-users/2015-August/msg00078.ht...;.
>  
>  Sorry, what you mean by "You're trying to use code for a much older
>  version"? Is there any other way more sophisticated?  
It's not necessarily safe to assume the API hasn't changed in six years.

In this case it looks ok. Just drop it into ipaserver/plugins instead,
restart httpd and it should work.

rob

>  
>  If yes, let me know please, I'm a complete newbie in FreeIPA.
>  
>  Thanks.
>  
>  Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org
>  <mailto:[e-mail]>> escreveu no dia terça,
>  16/03/2021 à(s) 23:02:
>  
>      Carlos Queen via FreeIPA-users wrote:
>      > Hello everyone,
>      >
>      > I want to change my email format and I searched out, I found an
>      instruction that uses a piece of python code in
>      /usr/lib/python2.7/site-packages/ipalib/plugins/, problem is that my
>      ipa server version is 4.6.8 and API 2.237 and it has not the
>      directory plugins.
>      >
>      > My question is: It is not possible to add plugins in this version?
>      Is there any other way to customize anything in freeipa?
>      >
>      > I hope you guys help me, thanks in advance.
>  
>      You're trying to use code for a much older version. It still might work
>      though. The plugins were moved to
>      <python_dir>/site-packages/ipaserver/plugins
>  
>      It would also help if you shared where you found the code and what
>      exactly you're trying to do.
>  
>      rob
>      _______________________________________________
>      FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      To unsubscribe send an email to
>      freeipa-users-leave(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      Fedora Code of Conduct:
>      https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>      List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>      List Archives:
>      https://lists.fedorahosted.org/archives/list/[e-mail]...
>      Do not reply to spam on the list, report it:
>      https://pagure.io/fedora-infrastructure
>

Deprecate/sync howto/troubleshooting DNS pages re: ds-seen requirement?

[Harry G. Coin]

Notice the two pages regarding DNSSEC (the 'howto' and the
'troubleshooting') discuss a requirement to give a command ( ... ds-seen
... ), requiring many arguments.  The docs call for this command to
occur for each domain after the DS key has been uploaded to the parent
domain, and required for key rollover operations.

'To-do' documentation proposes to automate that along with  many other
items-- all of which then is marked 'done'. 

I notice the 'drill' command to verify proper DNSSEC operation gives [T]
/ trusted results without having given the command that includes 'ds-seen'.

1)  Since whether the parent domain has a proper DS key is something
freeipa could determine without needing to be goaded by the user, it's
reasonable to suppose the automation of this has been accomplished and
so the requirement to given the ds-seen command mentioned in the
documentation obsolete?  Is it, and if so and ought it be marked as such?

2)  If it doesn't already, in the case where freeipa manages domain y.z 
and dnssec is enabled for domain x.y.z, freeipa ought load and
update/maintain the ds key for x.y.z into y.z automatically.

Thanks

Harry

Deprecate/sync howto/troubleshooting DNS pages re: ds-seen requirement?

[Florence Blanc-Renaud]

On 3/18/21 5:20 PM, Harry G. Coin via FreeIPA-users wrote:
>  Notice the two pages regarding DNSSEC (the 'howto' and the
>  'troubleshooting') discuss a requirement to give a command ( ... ds-seen
>  ... ), requiring many arguments.  The docs call for this command to
>  occur for each domain after the DS key has been uploaded to the parent
>  domain, and required for key rollover operations.
>  
>  'To-do' documentation proposes to automate that along with  many other
>  items-- all of which then is marked 'done'.
>  
>  I notice the 'drill' command to verify proper DNSSEC operation gives [T]
>  / trusted results without having given the command that includes 'ds-seen'.
>  
>  1)  Since whether the parent domain has a proper DS key is something
>  freeipa could determine without needing to be goaded by the user, it's
>  reasonable to suppose the automation of this has been accomplished and
>  so the requirement to given the ds-seen command mentioned in the
>  documentation obsolete?  Is it, and if so and ought it be marked as such?
>   
Hi,

as far as I know, this step hasn't been automated and it is still 
needed. As the doc state, it is required to enable key rotation.

You can refer to 
https://wiki.opendnssec.org/display/DOCS/Key+States#KeyStates-Publish%20f... 
to understand the key states. The command moves the KSK from ready to 
active and sets a date for key retirement.

It doesn't have any impact on the signed records (they are already 
available in the zone), but the zone remains unsecure until the records 
are uploaded to the parent zone. More information can be found in 
https://bind9.readthedocs.io/en/latest/dnssec-guide.html#uploading-inform...

flo

>  2)  If it doesn't already, in the case where freeipa manages
> domain y.z
>  and dnssec is enabled for domain x.y.z, freeipa ought load and
>  update/maintain the ds key for x.y.z into y.z automatically.
>  
>  Thanks
>  
>  Harry
>  
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
>