Issue

A method in serverroles server plugin uses is to compare two strings. attr.associated_role and role are strings. The code just happens to work because the strings are defined in the same module and scope, so Python reuses the string object. The problem prevents me to extend server roles with additional associate objects.

https://pagure.io/freeipa/blob/e5819bcae6779b89b6d11a144f293a4838344738/f/ipaserver/plugins/serverroles.py#_112

    def _get_assoc_attributes(self, role_name):
        role = self._get_role(role_name)
        assoc_attributes = {
            name: attr for name, attr in self.attributes.items() if
            attr.associated_role is role}

Related issue

servroles.role_instancesand servroles.attribute_instances are defined as tuples. This makes it also complicated to add additional roles and associated roles with a server plugin.

Version/Release/Distribution

All Fedora and RHEL versions with 4.9.11+ and 4.10.1+ are affected

• ipa-client-4.9.11-3.module+el8.8.0+17609+6cfecbae.x86_6
• ipa-client-4.10.1-3.el9.x86_64