BadRequest when using freeipa-python

[Ronald Wimmer]

Anyone using freeipa-python here? When I try to use

client.host_mod('myserver.mydomain.at', userclass='SomeUserClass')

the user class is set correctly on the host above but I do get an Exception:

File "./modifyHosts.py", line 34, in <module>
     client.host_mod('myserver.mydomain.at', userclass='SomeUserClass')
   File 
"/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py", 
line 11192, in host_mod
     return self._request(method, _args, _params)
   File 
"/usr/local/lib/python3.6/site-packages/python_freeipa/client.py", line 
335, in _request
     parse_error(error)
   File 
"/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py", 
line 117, in parse_error
     raise exception_class(message, code)
python_freeipa.exceptions.BadRequest: no modifications to be performed

What am I doing wrong?

[Rafael Jeffman]

On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users <
[e-mail]> wrote:
> Anyone using freeipa-python here? When I try to use
>
> client.host_mod('myserver.mydomain.at', userclass='SomeUserClass')
>
> the user class is set correctly on the host above but I do get an
> Exception:
>
> File "./modifyHosts.py", line 34, in <module>
>      client.host_mod('myserver.mydomain.at', userclass='SomeUserClass')
>    File
> "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
> line 11192, in host_mod
>      return self._request(method, _args, _params)
>    File
> "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py", line
> 335, in _request
>      parse_error(error)
>    File
> "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
> line 117, in parse_error
>      raise exception_class(message, code)
> python_freeipa.exceptions.BadRequest: no modifications to be performed

Note, on the last line that the error is "no modifications to be
performed". It used to occur to me when I tried to modify an object (in
this case a "host'), but all attributes already had the same given values.

I'd check if your host isn't already set, with the provided values.

Rafael

[Ronald Wimmer]

On 18.09.20 13:04, Rafael Jeffman via FreeIPA-users wrote:
> On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users 
> <[e-mail] 
> > wrote:
> Anyone using freeipa-python here? When I try to use
>
> client.host_mod('myserver.mydomain.at
> <http://myserver.mydomain.at>', userclass='SomeUserClass')
>
> the user class is set correctly on the host above but I do get an
> Exception:
>
>    File "./modifyHosts.py", line 34, in <module>
>      client.host_mod('myserver.mydomain.at
> <http://myserver.mydomain.at>', userclass='SomeUserClass')
>    File
> "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
>
> line 11192, in host_mod
>      return self._request(method, _args, _params)
>    File
> "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py",
> line
> 335, in _request
>      parse_error(error)
>    File
> "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
>
> line 117, in parse_error
>      raise exception_class(message, code)
> python_freeipa.exceptions.BadRequest: no modifications to be performed
>
>
> Note, on the last line that the error is "no modifications to be 
> performed". It used to occur to me when I tried to modify an object 
> (in this case a "host'), but all attributes already had the same given 
> values.

Thanks. Made no difference in my case.

host_find() returns only 100 servers whereas the FreeIPA WebGUI shows 132...

As there seems to be no other good python library the alternative would 
be handling JSON-RPC requests to FreeIPA on my own in a python script? 
Maybe I'll go that way. I just need to iterate over all registered hosts 
and fill the userclass attribute with host-mod.

Cheers,
Ronald

[Rob Crittenden]

Ronald Wimmer via FreeIPA-users wrote:
> On 18.09.20 13:04, Rafael Jeffman via FreeIPA-users wrote:
> > On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users
> > <[e-mail]
> > > wrote:
> > Anyone using freeipa-python here? When I try to use
> >
> > client.host_mod('myserver.mydomain.at
> > <http://myserver.mydomain.at>', userclass='SomeUserClass')
> >
> > the user class is set correctly on the host above but I do get an
> > Exception:
> >
> >    File "./modifyHosts.py", line 34, in <module>
> >      client.host_mod('myserver.mydomain.at
> > <http://myserver.mydomain.at>', userclass='SomeUserClass')
> >    File
> > "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
> >
> > line 11192, in host_mod
> >      return self._request(method, _args, _params)
> >    File
> > "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py",
> > line
> > 335, in _request
> >      parse_error(error)
> >    File
> > "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
> >
> > line 117, in parse_error
> >      raise exception_class(message, code)
> > python_freeipa.exceptions.BadRequest: no modifications to be performed
> >
> >
> > Note, on the last line that the error is "no modifications to be
> > performed". It used to occur to me when I tried to modify an object
> > (in this case a "host'), but all attributes already had the same given
> > values.
>
> Thanks. Made no difference in my case.
>
> host_find() returns only 100 servers whereas the FreeIPA WebGUI shows 132...
>
> As there seems to be no other good python library the alternative would
> be handling JSON-RPC requests to FreeIPA on my own in a python script?
> Maybe I'll go that way. I just need to iterate over all registered hosts
> and fill the userclass attribute with host-mod.

The default search size limit is 100. The UI may query for keys only and
it sounds like it is disabling the size limit.

rob

[Ronald Wimmer]

On 18.09.20 19:47, Rob Crittenden via FreeIPA-users wrote:
> Ronald Wimmer via FreeIPA-users wrote:
> > On 18.09.20 13:04, Rafael Jeffman via FreeIPA-users wrote:
> > > On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users
> > > <[e-mail]
> > > > wrote:
> > >  Anyone using freeipa-python here? When I try to use
> > >
> > >  client.host_mod('myserver.mydomain.at
> > >  <http://myserver.mydomain.at>', userclass='SomeUserClass')
> > >
> > >  the user class is set correctly on the host above but I do get an
> > >  Exception:
> > >
> > >     File "./modifyHosts.py", line 34, in <module>
> > >       client.host_mod('myserver.mydomain.at
> > >  <http://myserver.mydomain.at>', userclass='SomeUserClass')
> > >     File
> > >  "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
> > >
> > >  line 11192, in host_mod
> > >       return self._request(method, _args, _params)
> > >     File
> > >  "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py",
> > >  line
> > >  335, in _request
> > >       parse_error(error)
> > >     File
> > >  "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
> > >
> > >  line 117, in parse_error
> > >       raise exception_class(message, code)
> > >  python_freeipa.exceptions.BadRequest: no modifications to be performed
> > >
> > >
> > > Note, on the last line that the error is "no modifications to be
> > > performed". It used to occur to me when I tried to modify an object
> > > (in this case a "host'), but all attributes already had the same given
> > > values.
> >
> > Thanks. Made no difference in my case.
> >
> > host_find() returns only 100 servers whereas the FreeIPA WebGUI shows 132...
> >
> > As there seems to be no other good python library the alternative would
> > be handling JSON-RPC requests to FreeIPA on my own in a python script?
> > Maybe I'll go that way. I just need to iterate over all registered hosts
> > and fill the userclass attribute with host-mod.
>
> The default search size limit is 100. The UI may query for keys only and
> it sounds like it is disabling the size limit.

I guess the WebGUI limits the search size too. But it shows a total 
number of hosts on the hosts page. Can I disable that search limit when 
I want to iterate over all existing hosts?

Cheers,
Ronald

[Florence Blanc-Renaud]

On 9/21/20 7:55 AM, Ronald Wimmer via FreeIPA-users wrote:
> On 18.09.20 19:47, Rob Crittenden via FreeIPA-users wrote:
> > Ronald Wimmer via FreeIPA-users wrote:
> > > On 18.09.20 13:04, Rafael Jeffman via FreeIPA-users wrote:
> > > > On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users
> > > > <[e-mail]
> > > > > wrote:
> > > >
> > > > Anyone using freeipa-python here? When I try to use
> > > >
> > > > client.host_mod('myserver.mydomain.at
> > > >      http://myserver.mydomain.at', userclass='SomeUserClass')
> > > >
> > > > the user class is set correctly on the host above but I do get an
> > > >      Exception:
> > > >
> > > > File "./modifyHosts.py", line 34, in <module>
> > > >           client.host_mod('myserver.mydomain.at
> > > >      http://myserver.mydomain.at', userclass='SomeUserClass')
> > > >         File
> > > >
> > > > "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
> > > >
> > > > line 11192, in host_mod
> > > >           return self._request(method, _args, _params)
> > > >         File
> > > >      "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py",
> > > >      line
> > > >      335, in _request
> > > >           parse_error(error)
> > > >         File
> > > >
> > > > "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
> > > >
> > > > line 117, in parse_error
> > > >           raise exception_class(message, code)
> > > >      python_freeipa.exceptions.BadRequest: no modifications to be 
> > > > performed
> > > >
> > > > Note, on the last line that the error is "no modifications to be
> > > > performed". It used to occur to me when I tried to modify an object
> > > > (in this case a "host'), but all attributes already had the same given
> > > > values.
> > >
> > > Thanks. Made no difference in my case.
> > >
> > > host_find() returns only 100 servers whereas the FreeIPA WebGUI shows 
> > > 132...
> > >
> > > As there seems to be no other good python library the alternative would
> > > be handling JSON-RPC requests to FreeIPA on my own in a python script?
> > > Maybe I'll go that way. I just need to iterate over all registered hosts
> > > and fill the userclass attribute with host-mod.
> >
> > The default search size limit is 100. The UI may query for keys only and
> > it sounds like it is disabling the size limit.
>
> I guess the WebGUI limits the search size too. But it shows a total 
> number of hosts on the hosts page. Can I disable that search limit when 
> I want to iterate over all existing hosts?

You can specify a different limit in the host-find call (ipa host-find 
--sizelimit=xxx) but be aware that 389-ds also enforces limits set per 
user or per back-end. The limit specified in the host-find call will be 
capped by the limits defined on the server.

For instance in uid=admin,cn=users,cn=accounts,$BASE the attribute 
nsSizeLimit may define the limit applicable to operations performed by 
"admin" user.

More details in 389-ds administration guide: 
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht...

flo
> Cheers,
> Ronald
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: 
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Ronald Wimmer]

On 21.09.20 10:31, Florence Blanc-Renaud via FreeIPA-users wrote:
> On 9/21/20 7:55 AM, Ronald Wimmer via FreeIPA-users wrote:
> > On 18.09.20 19:47, Rob Crittenden via FreeIPA-users wrote:
> > > Ronald Wimmer via FreeIPA-users wrote:
> > > > On 18.09.20 13:04, Rafael Jeffman via FreeIPA-users wrote:
> > > > > On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users
> > > > > <[e-mail]
> > > > > > wrote:
> > > > >
> > > > > Anyone using freeipa-python here? When I try to use
> > > > >
> > > > > client.host_mod('myserver.mydomain.at
> > > > >      http://myserver.mydomain.at', userclass='SomeUserClass')
> > > > >
> > > > > the user class is set correctly on the host above but I do 
> > > > > get an
> > > > >      Exception:
> > > > >
> > > > > File "./modifyHosts.py", line 34, in <module>
> > > > >           client.host_mod('myserver.mydomain.at
> > > > >      http://myserver.mydomain.at', userclass='SomeUserClass')
> > > > >         File
> > > > > "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
> > > > >
> > > > > line 11192, in host_mod
> > > > >           return self._request(method, _args, _params)
> > > > >         File
> > > > > "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py",
> > > > >      line
> > > > >      335, in _request
> > > > >           parse_error(error)
> > > > >         File
> > > > > "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
> > > > >
> > > > > line 117, in parse_error
> > > > >           raise exception_class(message, code)
> > > > >      python_freeipa.exceptions.BadRequest: no modifications to be 
> > > > > performed
> > > > >
> > > > > Note, on the last line that the error is "no modifications to be
> > > > > performed". It used to occur to me when I tried to modify an object
> > > > > (in this case a "host'), but all attributes already had the same 
> > > > > given
> > > > > values.
> > > >
> > > > Thanks. Made no difference in my case.
> > > >
> > > > host_find() returns only 100 servers whereas the FreeIPA WebGUI 
> > > > shows 132...
> > > >
> > > > As there seems to be no other good python library the alternative 
> > > > would
> > > > be handling JSON-RPC requests to FreeIPA on my own in a python script?
> > > > Maybe I'll go that way. I just need to iterate over all registered 
> > > > hosts
> > > > and fill the userclass attribute with host-mod.
> > >
> > > The default search size limit is 100. The UI may query for keys only 
> > > and
> > > it sounds like it is disabling the size limit.
> >
> > I guess the WebGUI limits the search size too. But it shows a total 
> > number of hosts on the hosts page. Can I disable that search limit 
> > when I want to iterate over all existing hosts?
>
> You can specify a different limit in the host-find call (ipa host-find 
> --sizelimit=xxx) but be aware that 389-ds also enforces limits set per 
> user or per back-end. The limit specified in the host-find call will 
> be capped by the limits defined on the server.
>
> For instance in uid=admin,cn=users,cn=accounts,$BASE the attribute 
> nsSizeLimit may define the limit applicable to operations performed by 
> "admin" user.

Does the per-user setting override the global limit?

Cheers
Ronald

[João Baúto]

If you set the arg o_sizelimit to 0, it will get all hosts. The default
value (None) only fetches the first 100 entries which applies to all
commands.

- o_sizelimit (int, min value 0, max value 2147483647) – Maximum number
   of entries returned (0 is unlimited)

*João Baúto*
---------------

*Scientific Computing and Software Platform*
Champalimaud Research
Champalimaud Center for the Unknown
Av. Brasília, Doca de Pedrouços
1400-038 Lisbon, Portugal
fchampalimaud.org https://www.fchampalimaud.org/

Ronald Wimmer via FreeIPA-users 
escreveu no dia segunda, 21/09/2020 à(s) 12:10:
> On 21.09.20 10:31, Florence Blanc-Renaud via FreeIPA-users wrote:
> > On 9/21/20 7:55 AM, Ronald Wimmer via FreeIPA-users wrote:
> > > On 18.09.20 19:47, Rob Crittenden via FreeIPA-users wrote:
> > > > Ronald Wimmer via FreeIPA-users wrote:
> > > > > On 18.09.20 13:04, Rafael Jeffman via FreeIPA-users wrote:
> > > > > > On Thu, Sep 17, 2020 at 9:59 AM Ronald Wimmer via FreeIPA-users
> > > > > > <[e-mail]
> > > > > > > wrote:
> > > > > >  Anyone using freeipa-python here? When I try to use
> > > > > >
> > > > > >  client.host_mod('myserver.mydomain.at
> > > > > >  <http://myserver.mydomain.at>', userclass='SomeUserClass')
> > > > > >
> > > > > >  the user class is set correctly on the host above but I do
> > > > > >
> > > > > > get an
> > > > > >      Exception:
> > > > > >     File "./modifyHosts.py", line 34, in <module>
> > > > > >       client.host_mod('myserver.mydomain.at
> > > > > >  <http://myserver.mydomain.at>', userclass='SomeUserClass')
> > > > > >     File
>
> "/usr/local/lib/python3.6/site-packages/python_freeipa/client_meta.py",
> > > > > >  line 11192, in host_mod
> > > > > >       return self._request(method, _args, _params)
> > > > > >     File
> > > > > >
> > > > > > "/usr/local/lib/python3.6/site-packages/python_freeipa/client.py",
> > > > > >      line
> > > > > >      335, in _request
> > > > > >           parse_error(error)
> > > > > >         File
>
> "/usr/local/lib/python3.6/site-packages/python_freeipa/exceptions.py",
> > > > > >  line 117, in parse_error
> > > > > >       raise exception_class(message, code)
> > > > > >  python_freeipa.exceptions.BadRequest: no modifications to be
> > > > > >
> > > > > > performed
> > > > > >
> > > > > > Note, on the last line that the error is "no modifications to be
> > > > > > performed". It used to occur to me when I tried to modify an object
> > > > > > (in this case a "host'), but all attributes already had the same
> > > > > > given
> > > > > > values.
> > > > >
> > > > > Thanks. Made no difference in my case.
> > > > >
> > > > > host_find() returns only 100 servers whereas the FreeIPA WebGUI
> > > > > shows 132...
> > > > >
> > > > > As there seems to be no other good python library the alternative
> > > > > would
> > > > > be handling JSON-RPC requests to FreeIPA on my own in a python script?
> > > > > Maybe I'll go that way. I just need to iterate over all registered
> > > > > hosts
> > > > > and fill the userclass attribute with host-mod.
> > > >
> > > > The default search size limit is 100. The UI may query for keys only
> > > > and
> > > > it sounds like it is disabling the size limit.
> > >
> > > I guess the WebGUI limits the search size too. But it shows a total
> > > number of hosts on the hosts page. Can I disable that search limit
> > > when I want to iterate over all existing hosts?
> >
> > You can specify a different limit in the host-find call (ipa host-find
> > --sizelimit=xxx) but be aware that 389-ds also enforces limits set per
> > user or per back-end. The limit specified in the host-find call will
> > be capped by the limits defined on the server.
> >
> > For instance in uid=admin,cn=users,cn=accounts,$BASE the attribute
> > nsSizeLimit may define the limit applicable to operations performed by
> > "admin" user.
>
> Does the per-user setting override the global limit?
>
> Cheers
> Ronald
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Ronald Wimmer]

On 21.09.20 13:18, João Baúto wrote:
> If you set the arg o_sizelimit to 0, it will get all hosts. The 
> default value (None) only fetches the first 100 entries which applies 
> to all commands.
> o_sizelimit (int, min value 0, max value 2147483647) – Maximum
> number of entries returned (0 is unlimited)

Thanks a lot. This was helpful! Any ideas why I get a 
BadRequest-Response when doing a host_mod?

Cheers,
Ronald

[João Baúto]

Confirm which version of python-freeipa you are using. I started using v1.0
and had to change pretty much all function args.
Since v1.0, all args have a prefix of a_ or o_. I never used host_mod but
it should be o_userclass.

Cheers,
*João Baúto*
---------------

*Scientific Computing and Software Platform*
Champalimaud Research
Champalimaud Center for the Unknown
Av. Brasília, Doca de Pedrouços
1400-038 Lisbon, Portugal
fchampalimaud.org https://www.fchampalimaud.org/

Ronald Wimmer  escreveu no dia segunda, 21/09/2020 à(s)
12:26:
> On 21.09.20 13:18, João Baúto wrote:
>
> If you set the arg o_sizelimit to 0, it will get all hosts. The default
> value (None) only fetches the first 100 entries which applies to all
> commands.
> o_sizelimit (int, min value 0, max value 2147483647) – Maximum
>
> number of entries returned (0 is unlimited)
>
> Thanks a lot. This was helpful! Any ideas why I get a BadRequest-Response
> when doing a host_mod?
>
> Cheers,
> Ronald

[Ronald Wimmer]

On 21.09.20 14:03, João Baúto via FreeIPA-users wrote:
> Confirm which version of python-freeipa you are using. I started using 
> v1.0 and had to change pretty much all function args.
> Since v1.0, all args have a prefix of a_ or o_. I never used host_mod 
> but it should be o_userclass.

Thanks a lot. The "o_" and "a_" prefixes as well as the fact that the 
userclass attribute value to be set should not already exist were the 
key to success.

Cheers,
Ronald