freeipa

#8290 API inconsistencies
Opened by schlitzered. Modified

Open
Close Issue

Request for enhancement

As a client API developer, i would like to have a consistent API

Issue

The FreeIPA API has some inconsistencies in itself.

1: usually objects classes that have a mod, find, add and del method, also have a "show" method.

except for "trustdomain", this one is missing the show domain, while most likely one can use trustdomain_find, + specifying the "cn" to archive the same goal, this is somehow inconvenient.

2: the vault object class methods are completely wild, compared to the other object classes.
2.1: there is no "add" method, i guess what "add" is for other object classes, is "add_internal"
2.2: same for mod_internal

3: the "servrole" objects "takes_params" attribute, is a dict, where all other object classes use a list of dicts.

FYI: i am currently trying to create an auto generated Object oriented client for python, using the FreeIPA APi specs available.

Steps to Reproduce

take a look at the output of the "command" methods output, when setting every param to "all"

Actual behavior

API is inconsistent

Expected behavior

consistent API
(what do you expect to happen)

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

  1. Missing trustdomain_show it sounds like a good idea to me to add the feature. @abbra what do you think ?

  2. Vault plugin: The vault plugin works differently than most other plugins. A considerable amount of logic is implemented in the client library. The client library encrypts secrets and wraps the encryption key with the KRA transport cert. The vault client code also implements additional encryption schemes like private/public key encryption. The vault plugin behaves as designed and cannot be changed to behave like other plugins.

  3. takes_params is a tuple of parameter objects, not a list of dicts. The servrole code is just missing a comma.

https://github.com/freeipa/freeipa/pull/4592 addresses the issue with servrole.takes_params. Thanks for the report.

master:

  • b6476f591b0c2a2aa3dec280e3e4025d3ae4cfb2 servrole: takes_params must be a tuple

Adding trustdomain_show is OK, it should not expose more information than trustdomain_find already exposes.

As for vault, we have a plan to redesign it but it is a long term work, that's not simple to do, as @cheimes commented.

thanks for the information, and the two proposed fixes.

regarding vault, i will simply ignore it for now in the client APi i am building.

ipa-4-6:

  • e93deead602491af67030540aa3bddcbd16287e7 servrole: takes_params must be a tuple

ipa-4-8:

  • 1d2ec1824845dda1af96d2f12cdfe976499572c4 servrole: takes_params must be a tuple
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.