We have an operational need to track the userClass attribute for our IPA hosts over time, specifically in a git repository (don't ask).
I thought of several ways of doing this and I am looking for suggestions as to the best option. I also want to make the smallest possible modifications to FreeIPA.

1. Monitor the `cn=changelog` tree for changes affecting hosts. We would keep the last date our script ran and query the tree for items more recent than that. The major issue is that it doesn't look like you can query for ">=" against modifyTimestamp (at least, I get no results).

2. I found references to FreeIPA using `RFC 4533` instead of the old changelog sync. It seems like that might have been superseded by RFC 3928, but I can't find any documentation about that. I have also found references to 389ds supporting Persistent Searches, but again there doesn't seem to be great documentation. I am not sure I want to implement something without documentation about it being a supported feature.

Both options 1 and 2 would probably need a full sync every so often to make sure they didn't miss changes.

3. Create a FreeIPA plugin. This seems like overkill since I just need LDAP data and we would need to make sure it gets installed on all of our systems.

4. Just schedule a normal LDAP query every so often (i.e. maybe once an hour) and assume that changes aren't made so quickly that anything important would be lost. I like this option least since I don't know that I can trust that assumption.

Any thoughts about these (or other) methods?

Thank you,
- Y