Request for enhancement

As user , I want ipa CLI tool exit with distinct exit codes so that I can differentiate common error cases, when I use ipa tool for scripting. According to man ipa(1), the tool has only three exit codes: 0 for success, 2 for entry not found, and 1 for all other types of errors. There is no way to distinguish auth error from network error or EmptyModlist. When I create or modify entries in scripts, I want to ignore EmptyModlist or treat DuplicateEntry differently.

$ ipa user-add testuser --first Test --last User
ipa: ERROR: user with name "testuser" already exists
$ echo $?
1
$ ipa user-mod testuser --first Test --last User
ipa: ERROR: no modifications to be performed
$ echo $?
1
$ ipa user-show missingaccount
ipa: ERROR: missingaccount: user not found
$ echo $?
2

IPA's exceptions have an errno number. However the values are four digit numbers and therefore out of range for exit codes. Exit codes should be in range 0...127. AFAIK 255 is the max exit code.

I propose to add distinct exit codes to the following exception parent classes and leave exceptions. There might be more classes that could benefit from their own exit code:

• AuthenticationError classes
• AuthorizationError classes
• InvocationError classes
• ExecutionError classes
• NotFound (already mapped to 2)
• DuplicateEntry
• EmptyModlist
• InternalError

Implementation details: PublicError already has an rval attribute that is used as exit code. It's just a matter of extending rval and updating the man page.