msg: cannot import name 'kinit_password' from 'ipapython.ipautil about ansible-freeipa

[Tas-sos]

In my attempt to solve this, I have also installed the following python 3 modules.

pip freeze

ipa==4.10.2
ipaclient==4.10.2
ipalib==4.10.2
ipaplatform==4.10.2
ipapython==4.10.2
python-freeipa==1.0.8

ansible-core==2.15.9
certifi==2024.2.2
cffi==1.16.0
charset-normalizer==3.3.2
cryptography==42.0.5
decorator==5.1.1
dnspython==2.6.1
gssapi==1.8.3
idna==3.6
importlib-resources==5.0.7
Jinja2==3.1.3
MarkupSafe==2.1.5
netaddr==1.2.1
packaging==23.2
pkg_resources==0.0.0
pyasn1==0.5.1
pyasn1-modules==0.3.0
pycparser==2.21
pypng==0.20220715.0
PyYAML==6.0.1
qrcode==7.4.2
requests==2.31.0
resolvelib==1.0.1
six==1.16.0
typing_extensions==4.10.0
urllib3==2.2.1

[Tas-sos]

• Red Hat Enterprise Linux release 9.1 (Plow)
• Python 3.9.18

System python related packages

dnf install python3 python3-devel krb5-workstation krb5-libs krb5-devel gcc -y

dnf list installed | grep python

libcap-ng-python3.x86_64                      0.8.2-7.el9        
policycoreutils-python-utils.noarch           3.5-2.el9          
python-unversioned-command.noarch             3.9.18-1.el9_3.1   
python3.x86_64                                3.9.18-1.el9_3.1   
python3-attrs.noarch                          20.3.0-7.el9       
python3-audit.x86_64                          3.0.7-103.el9      
python3-babel.noarch                          2.9.1-2.el9        
python3-chardet.noarch                        4.0.0-5.el9        
python3-cloud-what.x86_64                     1.29.30-1.el9      
python3-configobj.noarch                      5.0.6-25.el9       
python3-dasbus.noarch                         1.4-5.el9          
python3-dateutil.noarch                       1:2.8.1-6.el9      
python3-dbus.x86_64                           1.2.18-2.el9       
python3-decorator.noarch                      4.4.2-6.el9        
python3-devel.x86_64                          3.9.18-1.el9_3.1   
python3-distro.noarch                         1.5.0-7.el9        
python3-dnf.noarch                            4.12.0-4.el9       
python3-dnf-plugin-versionlock.noarch         4.3.0-11.el9_3     
python3-dnf-plugins-core.noarch               4.3.0-11.el9_3     
python3-ethtool.x86_64                        0.15-2.el9         
python3-file-magic.noarch                     5.39-10.el9        
python3-firewall.noarch                       1.2.1-1.el9        
python3-gobject-base.x86_64                   3.40.1-6.el9       
python3-gobject-base-noarch.noarch            3.40.1-6.el9       
python3-gpg.x86_64                            1.15.1-6.el9       
python3-hawkey.x86_64                         0.67.0-3.el9       
python3-idna.noarch                           2.10-7.el9         
python3-iniparse.noarch                       0.4-45.el9         
python3-inotify.noarch                        0.9.6-25.el9       
python3-jinja2.noarch                         2.11.3-4.el9       
python3-jsonpatch.noarch                      1.21-16.el9        
python3-jsonpointer.noarch                    2.0-4.el9          
python3-jsonschema.noarch                     3.2.0-13.el9       
python3-ldap.x86_64                           3.4.3-2.el9        
python3-libcomps.x86_64                       0.1.18-1.el9       
python3-libdnf.x86_64                         0.67.0-3.el9       
python3-librepo.x86_64                        1.14.2-3.el9       
python3-libs.x86_64                           3.9.18-1.el9_3.1   
python3-libselinux.x86_64                     3.5-1.el9          
python3-libsemanage.x86_64                    3.5-2.el9          
python3-libxml2.x86_64                        2.9.13-2.el9       
python3-linux-procfs.noarch                   0.7.0-1.el9        
python3-markupsafe.x86_64                     1.1.1-12.el9       
python3-netifaces.x86_64                      0.10.6-15.el9      
python3-nftables.x86_64                       1:1.0.4-11.el9_3   
python3-oauthlib.noarch                       3.1.1-2.el9        
python3-perf.x86_64                           5.14.0-139.kpq0.el9
python3-pexpect.noarch                        4.8.0-7.el9        
python3-pip.noarch                            21.2.3-7.el9_3.1   
python3-pip-wheel.noarch                      21.2.3-6.el9       
python3-policycoreutils.noarch                3.5-2.el9          
python3-prettytable.noarch                    0.7.2-27.el9       
python3-psycopg2.x86_64                       2.8.6-6.el9        
python3-ptyprocess.noarch                     0.6.0-12.el9       
python3-pyasn1.noarch                         0.4.8-6.el9        
python3-pyasn1-modules.noarch                 0.4.8-6.el9        
python3-pyrsistent.x86_64                     0.17.3-8.el9       
python3-pyserial.noarch                       3.4-12.el9         
python3-pysocks.noarch                        1.7.1-12.el9       
python3-pytz.noarch                           2021.1-4.el9       
python3-pyudev.noarch                         0.22.0-6.el9       
python3-pyyaml.x86_64                         5.4.1-6.el9        
python3-requests.noarch                       2.25.1-6.el9       
python3-rpm.x86_64                            4.16.1.3-18.el9_1  
python3-setools.x86_64                        4.4.0-5.el9        
python3-setuptools.noarch                     53.0.0-10.el9      
python3-setuptools-wheel.noarch               53.0.0-10.el9      
python3-six.noarch                            1.15.0-9.el9       
python3-subscription-manager-rhsm.x86_64      1.29.30-1.el9      
python3-systemd.x86_64                        234-18.el9         
python3-urllib3.noarch                        1.26.5-3.el9

pip freeze

• requirements.txt

ansible-core==2.15.9

# Collections Requirements
# freeipa.ansible_freeipa.ipaservice
netaddr==1.2.1
gssapi==1.8.3
ipalib==4.10.2

ansible-core==2.15.9
cffi==1.16.0
cryptography==42.0.5
decorator==5.1.1
dnspython==2.6.1
gssapi==1.8.3
importlib-resources==5.0.7
ipalib==4.10.2
ipaplatform==4.10.2
ipapython==4.10.2
Jinja2==3.1.3
MarkupSafe==2.1.5
netaddr==1.2.1
packaging==23.2
pyasn1==0.5.1
pyasn1-modules==0.3.0
pycparser==2.21
PyYAML==6.0.1
resolvelib==1.0.1
six==1.16.0

But again exactly the same:

msg: cannot import name 'kinit_password' from 'ipapython.ipautil'

---

pip install ipaclient

pip freeze | grep ipa
ipaclient==4.10.2
ipalib==4.10.2
ipaplatform==4.10.2
ipapython==4.10.2

But, nothing changed.

[t-woerner]

ansible-freeipa modules are supporting management nodes that are part of an IPA domain as a client or server. If the node is part of an IPA domain, all the needed packages and bindings are installed and the management modules are able to be used.
ansible-core and ansible-freeipa is only needed on the controller, it is not needed on the management nodes.

[t-woerner]

The management node needs to deployed as a server/replica or client in an IPA domain.
Installing ipaclient with pip is not able to do this.

For information how to deploy a client, please have a look at https://github.com/freeipa/ansible-freeipa/blob/master/roles/ipaclient/README.md

[Tas-sos]

So, the task below cannot be run on my laptop - which is not an IPA server/client ( at least client ) ?

---
- name: Create service
  delegate_to: localhost
  freeipa.ansible_freeipa.ipaservice:
    name: "{{ item.principal }}"
    principal: "{{ item.aliases | default(omit) }}"
    state: "present"
    ipaadmin_principal: "{{ ipa_host_enrollment_principal }}"
    ipaadmin_password: "{{ ipa_host_enrollment_password }}"
  loop: "{{ custom_keytabs }}"

As you mentioned above from the Ansible controller side you only need ansible-core & ansible-freeipa.
So I cannot run the above from my localhost, if my localhost/controller is not already deployed as a server/replica or client in an IPA domain.

Excuse me, I'm confused because I ran it locally and the error message doesn't help me enough.
Could we change the error message to give more information about what is going wrong?
For example, with some kind of condition checking whether "Ω" has already been done or not, print "χ message", otherwise "ψ message".

Thank you very much for your prompt reply above and for the really useful reference which is really helpful! 🙏

[t-woerner]

Good point, please open a ticket to work on the error messages for missing IPA bindings.

[rjeffman]

@Tas-sos no, you can't delegate the task to your localhost if it is not a server or a client in a FreeIPA deployment.

The controller does not need to be part of FreeIPA, but any target node needs to be.

We should make this clearer in the documentation, but IMO, working this on the error messages provided will open a lot of unknown issues, and this might be too much work for too small improvement.