freeipa

#8955 Unstable fingerprints for the same API schema
Closed: fixed by frenaud. Opened by slev.

Closed: fixed
Reopen Issue

Each WSGI'ed process may cache API schema with different fingerprints.
Example reproducer:

from pprint import pprint
from deepdiff import DeepDiff
from ipalib import api
api.bootstrap(context="cli", in_server=False)
api.finalize()
api.Backend.rpcclient.connect()
res_old = None
for _ in range(10):
    res_new = api.Command.schema()
    if res_old is None:
        res_old = res_new
    if res_old["result"]["fingerprint"] != res_new["result"]["fingerprint"]:
        pprint(
            DeepDiff(
                res_old["result"],
                res_new["result"],
            )
        )

Example output:

{'values_changed': {"root['commands'][115]['params'][36]['exclude'][0]": {'new_value': 'cli',
                                                                          'old_value': 'webui'},
                    "root['commands'][115]['params'][36]['exclude'][1]": {'new_value': 'webui',
                                                                          'old_value': 'cli'},
                    "root['fingerprint']": {'new_value': 'a5ae74e2',
                                            'old_value': 'bab7c925'}}}
{'values_changed': {"root['commands'][115]['params'][36]['exclude'][0]": {'new_value': 'cli',
                                                                          'old_value': 'webui'},
                    "root['commands'][115]['params'][36]['exclude'][1]": {'new_value': 'webui',
                                                                          'old_value': 'cli'},
                    "root['fingerprint']": {'new_value': 'a5ae74e2',
                                            'old_value': 'bab7c925'}}}

Currently only dnsrecord_del command defines raw Flag with exclude=('cli', 'webui').
exclude Param's attribute is cast to frozenset (ipalib/parameters.py). The problem is in param._get_obj of ipaserver.plugins.schema which converts exclude and include attrs of Param to list. Set/frozenset in turn, is unordered collection [0]. So, it's expected behavior for them.

Note, other Param's attrs with type frozenset are not affected because they are not processed by the schema plugin.

IPA client fetches API schema from a server only if the schema is invalid (outdated, damaged, missed, etc.) and doesn't validate the fingerprint. So, the only possible impact I see is the cluttering of the local cache with two variants of schema cache(for each used language).

IPA version:

[root@master1 /]# ipa --version
VERSION: 4.9.6, API_VERSION: 2.242

[0]: https://docs.python.org/3/library/stdtypes.html#set-types-set-frozenset

Metadata Update from @slev:
- Issue assigned to slev

Metadata Update from @slev:
- Issue assigned to slev

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5979

master:

  • 3eb0759a6d501348cf581e433f195aba3e548f5a schema plugin: Generate stable fingerprint
  • 77e7ac3592c0a708aa496275fa21e18bd6d01c1d ipatests: Add tests for schema Command

ipa-4-9:

  • 939d0f5df67aa39cd31f68a6da4153460066ca66 schema plugin: Generate stable fingerprint
  • 14ad52238543ab845a8d6dadd65ff2fb6e67d8df ipatests: Add tests for schema Command

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.