freeipa

#8317 XML-RCP and CLI tests depend on internal --force option
Opened by cheimes. Modified

Open
Close Issue

Issue

ipatests/test_xmlrpc/test_dns_plugin.py and ipatests/test_cmdline/test_cli.py use --force` /force=True/{'force' : True}for commands likepermission-delordnsrecord-add. The force option hasflags=['no_option']`` meaning that the option is not available outside of server context.

The server context is accessible for servers. https://pagure.io/freeipa/issue/8312 fixes detection logic for api.env.in_tree setting, which results in tests now using the proper client-side context. This breaks tests that assume that use the force option.

Possible fixes

  1. Modify tests to not use force and figure out how to test force code paths by other means.
  2. Modify tests to not use force and remove all code paths related to force option.
  3. Allow JSON-RPC and XML-RPC to use the force option but don't show it in CLI and UI with exclude=('cli', 'webui').
  4. Treat users as adults, hand them a footgun (so they can shoot themselves in the foot), and allow force in CLI and UI

I'm leaning towards option 3. It's the least work and gives limited exposure to a feature that somebody deemed important in the past.

Metadata Update from @cheimes:
- Custom field blocking adjusted to 8312
- Issue marked as blocking: #8312
- Issue priority set to: normal
- Issue set to the milestone: FreeIPA 4.8.7

I am not in favor of opening these powerful options to the API.

It's unclear from this report how in_tree factors in. Could you instead set in_server? Seems like that would more closely duplicate a real environment anyway.

The in_tree option changes how remote plugin behave, see https://pagure.io/freeipa/blob/master/f/ipaclient/remote_plugins/init.py#_119

NOTE Remove kwargs.update(in_tree=True), too.

master:

  • 13c3997baa97b7974870cb2353caa4ced8f134d1 Fix detection logic for api.env.in_tree
  • 0fa31ef123a544378f04a2177524c9f72181a812 Hard-code in_tree=True for tests

ipa-4-8:

  • 6cd2d44707c69b6c83c0eaae3a94d6f64c6c1622 Fix detection logic for api.env.in_tree
  • 834b04b91dff670d3f0feb1b403705074a8f3d5b Hard-code in_tree=True for tests

My opinion after reading through the code:
- for DNS record we should make --force available. This should be useful for bootstrapping NS record for zones where you indeed would have unresolved record at that point. So, treat users as adults here. All tests imply this setup, it seems.
- for permissions, I believe that we need to rework tests that create and delete 'system' permissions. Simply use direct LDAP operations to delete them if needed or move those tests out of xmlrpc test suite completely.

master:

  • ad8e0af0770caf039ff6c431a3182238c1952f8f Allow dnsrecord-add --force on clients

ipa-4-8:

  • c261a6eb768483f7ac45aab34994dcec01e819bd Allow dnsrecord-add --force on clients
Metadata
None
None
None
None
Normal
8312
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.