freeipa

#7966 Add support for JSON-RPC in ipa-join
Closed: fixed by abbra. Opened by cheimes.

Closed: fixed
Reopen Issue

Request for enhancement

We want to deprecate and eventually remove the XML-RPC interface in favor of JSON-RPC. The ipa-join command is currently implemented in C and uses libxmlrpc-client to talk to IPA servers. It's the last command that requires XML-RCP API and libxmlrpc-client in the FreeIPA sources tree. AFAIK only certmonger and ipa-join depend on XML-RCP at all.

Rather than re-implementing the XML-RPC part of ipa-join.c with some JSON-RPC library, it is probably easier and less risky to replace the implementation with a pure Python implementation. The command is not terribly complicated:

  • it connects to LDAP to retrieve the root DN and verify that the server is an IPA server.
  • it creates fqdn=$HOSTNAME,cn=computers,cn=accounts,$SUFFIX
  • it calls the join RPC endpoint on installation and host_disable endpoint on uninstallation
  • it runs ipa-getkeytab

As a side note on the Certmonger situation - seems like a good opportunity to reimplement the IPA renewal helper and take control of it from Certmonger (perhaps shipping it as a separate package on its own release cadence, or perhaps part of ipa-client).

Alexander mentioned that he would rather replace libxmlrpc-client with a JSON RPC C-library than to reimplement ipa-join in Python.

[WIP] https://github.com/freeipa/freeipa/pull/3544

PR 3544 uses libjson-c. I would rather use jansson than libjson-c. Nathaniel is using the library in libjose and I very much enjoined using it. jansson has a high level formatting and parsing API that works similar to Python's high level C API for parsing and building complex objects. jansson is available in Fedora and RHEL.

Example:

json_unpack(jsonobj, "{s:s, s:i}", "key1", &s, "key2", &i);

master:

  • 6e414d22919822bb6f18b8b03f223de9e08569ef ipa-join: allowing call with jsonrpc into freeipa API
  • 5e7e4f0e262caef0bae1518a575bb98f69a9d7e1 ipa-join: don't set TLS related curl options for JSON-RPC
  • c197918e8d220f10676f42b3589e47599b7a11e5 ipa-join: improve curl error handling in JSON-RPC code
  • c905f94f9b829faec03a016ebd7a344caf3ca144 ipa-join: buffer curl response before parsing json
  • 25205f44a10b9e4846121d1a9b05aafa74485292 ipa-join: switch to jansson for json handling
  • 677659c8da27de7b256b7067e513f089892d05b8 ipa-join: extract unenrollment code common to JSON and XML-RPC to separate function
  • 62503e4fd0e92aae60da49e6917ac62ea52def96 ipa-join: implement JSON-RPC based unenrollment
  • f6940772dd9d5f550e9ce4ff20c779864ad4eb68 ipa-join: select {JSON,XML}-RPC at build time
  • a1b117a28b670c71e60fdd1c0ec0c6ef8f8f438b ipa-join: Use bool type where appropriate
  • 7cc977b993c30add2ba6ec2f823d782cc4d99f7f ipa-join: Generalize XML-RPC references in man page

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to ipa-join tool defaults to use of JSON-RPC protocol when communicating to IPA masters by default. The choice of JSON-RPC or XML-RPC is a compile-time setting now.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.