Hi, as you have probably noticed in a thread we had with Leo on freeipa-users@ about FreeIPA plugin development, we hadn't had consistency in handling boolean types between LDAP and IPA Python API level. A change is coming that would make 'native' boolean types used in both worlds. If your plugins rely on Bool() parameter handling in FreeIPA, your code might be affected. If your scripts using output of IPA API rely on case-sensitive output, you might need to adjust your code. If not, you can skip this email. Pull request https://github.com/freeipa/freeipa/pull/6294 turns handling of boolean types to be native to each side: - in LDAP, TRUE and FALSE strings used to represent the values - in Python, native True and False constants of bool type will be used to represent an LDAP boolean. Prior to PR#6294, when an LDAP attribute with a boolean syntax was read from LDAP, its representation in IPA Python code was either 'TRUE' or 'FALSE' string. This created a bit of inconvenience: - Python code had to explicitly compare a value to 'TRUE' or 'FALSE', - Web UI JavaScript code had to use a radio-box where a simple checkbox would be enough - JavaScript plugin code would need to handle all types of 'TRUE', 'FALSE', 1, 0, true, false, none in every place where a boolean type would be enough After PR#6294 is merged, IPA Python code will use Python bool type. JSON-RPC response to an IPA API command request would produce a simple 'true' or 'false' instead of ["TRUE"] or ["FALSE"] elements. This means, for example, that in the following command ipa dnszone-show ipa.test instead of "idnsallowdynupdate": [ "TRUE" ], one would get "idnsallowdynupdate": [ true ], and the output of 'ipa dnszone-show ipa.test' would have 'True' instead of 'TRUE' (and False instead of 'FALSE'): $ ipa dnszone-show ipa.test Zone name: ipa.test. Active zone: True Authoritative nameserver: idm.ipa.test. Administrator e-mail address: hostmaster.ipa.test. SOA serial: 1654159048 SOA refresh: 3600 SOA retry: 900 SOA expire: 1209600 SOA minimum: 3600 BIND update policy: grant IPA.TEST krb5-self * A; grant IPA.TEST krb5-self * AAAA; grant IPA.TEST krb5-self * SSHFP; Dynamic update: True Allow query: any; Allow transfer: none; If your scripts rely on the case-sensitive output, you'd need to fix them. IPA tools already able to handle the changes so they are backward-compatible. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland