For automation of FreeIPA installation with Ansible, Puppet and similar systems, FreeIPA needs to grow an API to query the state of various parts and information about the current system. Relevant pieces of information are

state

• is host enrolled as IPA client?
• is host enrolled as IPA server?
  • is BIND DNS server configured on the host?
  • is Dogtag PKI configured as CA on the host?
  • is Dogtag PKI configured as KRA on the host?

information

• domain
• Kerberos realm
• IPA master server
• URI of XML/JSON-RPC
• LDAP basedn
• LDAP URI
• CA cert
• supported API version (ipalib)
• FreeIPA version (numeric and vendor version)

Bonus: paths from ipaplatform.paths and LDAP containers from ipalib.api.env, see https://fedorahosted.org/freeipa/ticket/6408#comment:17

The checks must not require any kind of additional credentials or authentication. We can safely assume that checks are performed as root user on the machine. Checks must not depend on any running services like LDAP or web framework, too. Check must be able to detect that ipa-server-install has been called even when LDAP is down.

Additional checks against LDAP and framework may be perform in an advanced mode or by a second API in order to verify consistency between local config files and values in LDAP.