Addendum for all the people using Google:
The correct REST API parameter is indeed "all":true, once the correct
permissions are given to the user doing the query the attributes are
visible. The python-freeipa module can also get the attributes.
The answer is: Security stops you doing things you're not allowed to do.
# Call to actual method
curl -v \
-H referer:https://$IPAHOSTNAME/ipa \
-H "Content-Type:application/json" \
-H "Accept:applicaton/json" \
-c $COOKIEJAR -b $COOKIEJAR \
--cacert /etc/ipa/ca.crt \
-d
'{"method":"user_find","params":[[],{"all":true}],"id":0}'
\
-X POST https://$IPAHOSTNAME/ipa/session/json
From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
Sent: Tuesday, 7 November 2017 9:03 AM
To: Alexander Bokovoy <abokovoy(a)redhat.com>
Cc: Rob Crittenden <rcritten(a)redhat.com>; FreeIPA users list
<freeipa-users(a)lists.fedorahosted.org>
Subject: Re: [Freeipa-users] Re: Searching for user by extended attribute
I am on a bus :) your suggestion are things I have already tried. I know the
command line works.
My question is "what is the correct REST API query parameter that duplicates
the -all command line parameter?"
Get Outlook for iOS <
https://aka.ms/o0ukef>
_____
From: Alexander Bokovoy <abokovoy(a)redhat.com <mailto:abokovoy@redhat.com> >
Sent: Tuesday, November 7, 2017 8:51:59 AM
To: Aaron Hicks
Cc: Rob Crittenden; FreeIPA users list
Subject: Re: [Freeipa-users] Re: Searching for user by extended attribute
On ma, 06 marras 2017, Aaron Hicks wrote:
I am querying the REST API and it does not respond the same as the
command line. So I know that command works and it gives the information
I want. I need the REST API (which I'm querying via a python module
using plain ordinary HTTP requests) to give the same information.
I'd like to know the correct REST query or figure if the REST API has a
bug.
So, did you try to use exactly same JSON request as 'ipa -vvv user-find
--all' shows?
From your terse responses it is unclear at what state you are since my
morning's answers. You seem to ignore suggestions we made -- at least,
you are not showing what's different for you.
Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: Rob Crittenden <rcritten(a)redhat.com <mailto:rcritten@redhat.com> >
Sent: Tuesday, November 7, 2017 8:31:31 AM
To: FreeIPA users list; Alexander Bokovoy
Cc: Aaron Hicks
Subject: Re: [Freeipa-users] Re: Searching for user by extended attribute
Aaron Hicks via FreeIPA-users wrote:
> Sorry, this does not address that the REST API is giving a different
> response than the command line or built in Python API.
>
> This behaviour is unexpected and not described in the documentation.
What difference is that? I ran your command and user-find and got
identical output.
rob
>
> Get Outlook for iOS <
https://aka.ms/o0ukef>
> ------------------------------------------------------------------------
> *From:* Alexander Bokovoy <abokovoy(a)redhat.com
<mailto:abokovoy@redhat.com> >
> *Sent:* Monday, November 6, 2017 8:14:29 PM
> *To:* FreeIPA users list
> *Cc:* Aaron Hicks
> *Subject:* Re: [Freeipa-users] Re: Searching for user by extended
attribute
>
> On ma, 06 marras 2017, Aaron Hicks via FreeIPA-users wrote:
>>Hi everyon,
>>
>>This seems to be a flaw in the FreeIPA API itself.
>>
>>Using curl and the session method Alexander wrote up here:
>>https://vda.li/en/posts/2015/05/28/talking-to-freeipa-api-with-sessions/
>>
>>There is no combination of the 'all':somevalue that seem to trigger a
proper
>>all response. This is either broken or improperly documented.
I've tried
>>'all':True 'all':1 all:'True'
>>
>>This is the curl request I'm making at the end:
>>
>>curl -v \
>> -H referer:https://$IPAHOSTNAME/ipa \
>> -H "Content-Type:application/json" \
>> -H "Accept:applicaton/json" \
>> -c $COOKIEJAR -b $COOKIEJAR \
>> --cacert /etc/ipa/ca.crt \
>> -d
'{"method":"user_find","params":[[""],{"all":"true"}],"id":0}'
\
>> -X POST https://$IPAHOSTNAME/ipa/session/json
> See my other answer.
>
> I think what you are confused about as well is the fact that 'user_find'
> is not the command that returns _everything_ from the user entries it
> finds. Instead, it returns a curated list of attributes -- there are two
> lists, actually, -- one for a normal (without --all) and one for
> extended operation. The reason for that is because in all
> '<object>-find' calls we don't want to resolve potential
membership
> information for an object to be returned. The list of members/membership
> would be too involving in case of a large database which would slow down
> find operations a lot. As result, we tuned find operation to provide a
> smaller subset (still, --all produces a bit larger one too). If you need
> all attributes, use '<object>-show' instead, once you found the name
for
> an object.
>
>
>
>>
>>-----Original Message-----
>>From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
>>Sent: Monday, 6 November 2017 3:20 PM
>>To: 'Alexander Bokovoy' <abokovoy(a)redhat.com
<mailto:abokovoy@redhat.com>
; 'FreeIPA users list'
>><freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org> >
>>Subject: RE: [Freeipa-users] Searching for user by extended
attribute
>>
>>Ah, another point of difference is that I'm using this module to
communicate
>>with the API
https://github.com/opennode/python-freeipa
>>
>>I've not found any documentation for using any Python modules provided by
>>FreeAPI itself in standalone python scripts, rather than via the ipa
>>console...
>>
>>-----Original Message-----
>>From: Aaron Hicks [mailto:aaron.hicks@nesi.org.nz]
>>Sent: Monday, 6 November 2017 10:20 AM
>>To: 'Alexander Bokovoy' <abokovoy(a)redhat.com
<mailto:abokovoy@redhat.com>
; 'FreeIPA users list'
>><freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org> >
>>Subject: RE: [Freeipa-users] Searching for user by extended
attribute
>>
>>Ugh, on further testing; the ipa python console is giving different
>>responses that the code I'm using in a python script.
>>
>>In the ipa console, the additional attributes are listed.
>>
>>In the script I'm setting up a python-freeipa.Client object (called
>>client)and passing the following call:
>>
>>client.user_find(all=True)
>>
>>and the user records that are returned are still only the 'default'
>>attributes, even though the attributes are set and have values.
>>
>>This is the code I'm testing, it's loading all the variables from a
>>configuration file provided by the config object.
>>
>># First two lines import the project's configuration and logging objects
>>from this.configuration import config, args from this.log import
base_logger
>>from python_freeipa import Client
>>
>>logger = base_logger.getChild(__name__)
>>
>>if config['freeipa'].getboolean('enabled') is True:
>> if config['freeipa'].getboolean('verify_ssl') is not True:
>> logger.warning(
>> 'Verifying TLS connection to %s disabled.' %
>> config['freeipa']['server']
>> )
>> logger.info('freeIPA startup')
>> client = Client(
>> config['freeipa']['server'],
>> version=config['freeipa']['version'],
>> verify_ssl=config['freeipa'].getboolean('verify_ssl')
>> )
>> client.login(
>> config['freeipa']['user'],
>> config['freeipa']['password']
>> )
>>else:
>> logger.info('freeIPA disabled')
>>
>>def ipa_query(*dargs, **kwargs):
>> if config['freeipa'].getboolean('enabled') is True:
>> return client.user_find(*dargs, **kwargs)
>> else:
>> logger.info('freeIPA disabled')
>> return None
>>
>>ipa_query(all=True)
>>
>>Regards,
>>
>>Aaron
>>
>>
>>-----Original Message-----
>>From: Alexander Bokovoy [mailto:abokovoy@redhat.com]
>>Sent: Friday, 3 November 2017 7:10 PM
>>To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org> >
>>Cc: Aaron Hicks <aaron.hicks(a)nesi.org.nz
<mailto:aaron.hicks@nesi.org.nz>
>>Subject: Re: [Freeipa-users] Searching for user by extended attribute
>>
>>On pe, 03 marras 2017, Aaron Hicks via FreeIPA-users wrote:
>>>Hi all,
>>>
>>>
>>>
>>>We've added two objectclasses to the default user in our FreeIPA
instance.
>>>We're able to set and modify them fine, however we
need two additional
>>>functions.
>>>
>>>
>>>
>>>We need two additional attributes auedupersonsharedtoken and
>>>edupersonprinciplename to be included in the user attributes when
>>>executing user-find with the python-freeipa module. It works fine from
>>>the command line by adding the --all argument, but there's no
>>>equivalent to --all the python-freeipa module.
>>It is all there.
>>
>>$ ipa console
>>(Custom IPA interactive Python console)
>>>>> len(api.Command.user_find()['result'][0])
>>11
>>>>> len(api.Command.user_find(all=True)['result'][0])
>>24
>>
>>>We need to be able to user-find to search for users by these
>>>attributes, both from the command line and the python-freeipa module.
>>>There does not seem to be an equivalent of the --setattr command on the
>>>find function to search by attributes provided by additional
>>>objectclass
>>schema.
>>This is a bit different. You need to make sure you injected those
attributes
>>into existing object definitions if you want to see them used
by the
>>baseldap.py machinery.
>>
>>Can you show a code you use to extend IPA classes?
>>
>>--
>>/ Alexander Bokovoy
>>
>>
>>_______________________________________________
>>FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>
> --
> / Alexander Bokovoy
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>
--
/ Alexander Bokovoy