Request for enhancement

As an admin I want to debug why a host is not contacting IPA servers within its location.

Issue

While investigating the above I basically discovered #9257 for myself, and I wanted to create the missing idnsTemplateAttribute attribute on my _kerberos.example.com DNS record.

The problem is that the API doesn't let me do this, so I had to do it with ldapmodify.

Ok this is a fairly uncommon thing to do, and once the fixes for #9257 are available it's not something I'd have to do by hand. However it occurs to me that it would be nice to have the special state of records with an idnsTemplateAttribute attribute at least displayed in the web console and CLI. This would make problem investigation easier because the special state of these DNS records is not discoverable.

To be specific, I was looking at the _ldap._tcp and _kerberos records for a while, in order to see why querying for _ldap.tcp gave me a CNAME but _kerberos did not. And there's no difference presented in the web UI or the CLI.

(Actaully the CLI does disclose the idnsTemplateAttribute attribute, but only if you know to ask for it with --all; which I didn't do because I didn't know to do so, because I didn't know about the existance of the idnsTemplateAttribute attribute in the first place...)

Steps to Reproduce

1. Create a location
2. Add a server to a location
3. Run ipa dns-update-system-records

Actual behavior

URI and TXT attributes for e.g., _kerberos.example.com are editable in the UI/CLI, but those edits have no effect because really the hidden idnsTemplateAttribute causes them to be masked when the DNS server generates responses based on the template, rather than the data for the entry itself.

Expected behavior

A few ideas:

• Indicate in the web UI that a DNS record with an idnsTemplateAttribute is special and that the attributes shown are not actaully used. They could even be greyed out or hidden in an expander box.
• Print a similar warning when modifying DNS records via the CLI
  Some sort of indication on the page that this is a base record that is overridden by location-specific records. The goal is to reduce confusion when an admin who isn't familiar with how location discovery works in terms of how the DNS zones are stored in LDAP.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.10-6.module+el8.7.0+16405+581a7c1e.x86_64
ipa-client-4.9.10-6.module+el8.7.0+16405+581a7c1e.x86_64
389-ds-base-1.4.3.30-6.module+el8.7.0+16373+1a59bba2.x86_64
package pki-ca is not installed
krb5-server-1.18.2-22.el8_7.x86_64