freeipa

#9439 Make "ipa env" usable for scripting
Opened by cheimes. Modified

Open
Close Issue

Request for enhancement

As an administrator , I want a simple way to retrieve config settings from ipa CLI so I can get settings in scripts, e.g. curl $(ipa env jsonrpc_uri) -> curl https://server.ipa.example/ipa/json.

The ipa env command can be used to print IPA's settings from api.env:

$ ipa env
  api_version: 2.251
  basedn: dc=ipa,dc=example
  bin: /bin
  ca_agent_port: 443
  ca_host: server.ipahcc.test
  ca_install_port: None
  ca_port: 80
  certmonger_wait_timeout: 300
  conf: /etc/ipa/cli.conf
  conf_default: /etc/ipa/default.conf
  confdir: /etc/ipa
  config_loaded: True
  container_accounts: cn=accounts
  container_adtrusts: cn=ad,cn=trusts
  ...

The command can also print a single value. However it prefixes the output with spaces and the key. This makes it rather awkward to use the output in a script.

$ ipa env jsonrpc_uri
  jsonrpc_uri: https://server.ipa.example/ipa/json

Proposal

Either change the default to not include spaces + key prefix when printing a single argument. Or add a short option to suppress the prefix, e.g. ipa env -s jsonrpc_uri -> https://server.ipa.example/ipa/json.

Bonus points if you include a way to retrieve multiple values with a template expression like ipa env -t '{container_user},{basedn}' -> cn=users,cn=accounts,dc=ipa,dc=example.

I would avoid changing the defaults at this time. Adding an option would be fine.

The question I have is how you would like to have this used? We already have use for IPA's configuration files in other utilities by importing those files as environment files. This is done by ipa-otpd with EnvironmentFile variable:

# systemctl cat ipa-otpd@.service
# /usr/lib/systemd/system/ipa-otpd@.service
[Unit]
Description=ipa-otpd service
[Service]
Environment=LC_ALL=C.UTF-8
EnvironmentFile=/etc/ipa/default.conf
ExecStart=/usr/libexec/ipa/ipa-otpd $ldap_uri
StandardInput=socket
StandardOutput=socket
StandardError=journal
....

Do you need = or : as a separator? May be even JSON output would be better?

I would like to have an option that only prints the raw value for a key without any prefix or suffix, so I can retrieve values with a subshell expression:

$ echo $(ipa env --someoption jsonrpc_uri)
https://server.ipa.example/ipa/json

Now that you mention it, it might also be a good idea to have an option that returns shell compatible key-value pairs with proper quotes, perhaps with IPA_ prefix to avoid name clashes in shell scripts.

$ ipa env --shell
IPA_API_VERSION='2.251'
IPA_BASEDN='dc=ipa,dc=example'
...

PS: I'm currently writing another feature request for ipa --json.

So, we can take three options:

  • --raw: make a raw value output without variable name and separator, only works for explicitly specified option and cannot be used for a request without option name
  • --shell: make a name=value output with singular quotes, potentially multiple options can be specified (or none, then everything in the environment is printed out)
  • --json: make JSON-formated output similar to --shell.
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.