#7966 Reimplement ipa-join in Python
Closed: fixed a month ago by abbra. Opened a year ago by cheimes.

Request for enhancement

We want to deprecate and eventually remove the XML-RPC interface in favor of JSON-RPC. The ipa-join command is currently implemented in C and uses libxmlrpc-client to talk to IPA servers. It's the last command that requires XML-RCP API and libxmlrpc-client in the FreeIPA sources tree. AFAIK only certmonger and ipa-join depend on XML-RCP at all.

Rather than re-implementing the XML-RPC part of ipa-join.c with some JSON-RPC library, it is probably easier and less risky to replace the implementation with a pure Python implementation. The command is not terribly complicated:

  • it connects to LDAP to retrieve the root DN and verify that the server is an IPA server.
  • it creates fqdn=$HOSTNAME,cn=computers,cn=accounts,$SUFFIX
  • it calls the join RPC endpoint on installation and host_disable endpoint on uninstallation
  • it runs ipa-getkeytab

As a side note on the Certmonger situation - seems like a good opportunity to reimplement the IPA renewal helper and take control of it from Certmonger (perhaps shipping it as a separate package on its own release cadence, or perhaps part of ipa-client).

Alexander mentioned that he would rather replace libxmlrpc-client with a JSON RPC C-library than to reimplement ipa-join in Python.

PR 3544 uses libjson-c. I would rather use jansson than libjson-c. Nathaniel is using the library in libjose and I very much enjoined using it. jansson has a high level formatting and parsing API that works similar to Python's high level C API for parsing and building complex objects. jansson is available in Fedora and RHEL.

Example:

json_unpack(jsonobj, "{s:s, s:i}", "key1", &s, "key2", &i);

master:

  • 6e414d2 ipa-join: allowing call with jsonrpc into freeipa API
  • 5e7e4f0 ipa-join: don't set TLS related curl options for JSON-RPC
  • c197918 ipa-join: improve curl error handling in JSON-RPC code
  • c905f94 ipa-join: buffer curl response before parsing json
  • 25205f4 ipa-join: switch to jansson for json handling
  • 677659c ipa-join: extract unenrollment code common to JSON and XML-RPC to separate function
  • 62503e4 ipa-join: implement JSON-RPC based unenrollment
  • f694077 ipa-join: select {JSON,XML}-RPC at build time
  • a1b117a ipa-join: Use bool type where appropriate
  • 7cc977b ipa-join: Generalize XML-RPC references in man page

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

a month ago

Metadata Update from @abbra:
- Custom field changelog adjusted to ipa-join tool defaults to use of JSON-RPC protocol when communicating to IPA masters by default. The choice of JSON-RPC or XML-RPC is a compile-time setting now.

a month ago

Login to comment on this ticket.

Metadata