plugins: Increase minimum supported IPA version to 4.6.8

[t-woerner]

This is preparation work for the SIX removal in Ansible that will drop support for RHEL-7 (Python 2) and together with this support for IPA versions prior to 4.8.4.

The goal is to remove code that was needed for IPA versions prior to 4.6.8. Aso to mark the code and special cases with the IPA versions that needed these.

Summary by Sourcery

Raise the minimum supported FreeIPA version and simplify version-dependent IPA integration logic in the Ansible FreeIPA module utilities.

Bug Fixes:

• Fail fast with a clear runtime error when the installed FreeIPA version is older than the newly required minimum.

Enhancements:

• Derive a unified IPA_PYTHON_VERSION from ipapython.version and enforce a minimum FreeIPA version of 4.6.8.
• Remove compatibility fallbacks for deprecated FreeIPA and certificate APIs that are no longer needed with the higher minimum version.
• Streamline detection of IPA configuration status by relying on modern is_ipa_configured imports and dropping legacy fallback implementations.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• You compute IPA_PYTHON_VERSION for older FreeIPA releases but then perform the minimum-version check against NUM_VERSION; if NUM_VERSION semantics differ pre-3.2.1 as implied by the comment, the check should likely use IPA_PYTHON_VERSION instead to avoid mis-detecting supported/unsupported versions.
• Consider making the RuntimeError message more explicit by including the minimum supported FreeIPA version (e.g. >= 4.6.8) so users immediately know what they need to upgrade to when the check fails.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- You compute `IPA_PYTHON_VERSION` for older FreeIPA releases but then perform the minimum-version check against `NUM_VERSION`; if `NUM_VERSION` semantics differ pre-3.2.1 as implied by the comment, the check should likely use `IPA_PYTHON_VERSION` instead to avoid mis-detecting supported/unsupported versions.
- Consider making the `RuntimeError` message more explicit by including the minimum supported FreeIPA version (e.g. `>= 4.6.8`) so users immediately know what they need to upgrade to when the check fails.

## Individual Comments

### Comment 1
<location path="plugins/module_utils/ansible_freeipa_module.py" line_range="116-124" />
<code_context>
     from ipalib.config import Env
     from ipalib.constants import DEFAULT_CONFIG, LDAP_GENERALIZED_TIME_FORMAT

     try:
+        # IPA >= 4.12.0
         from ipalib.kinit import kinit_password, kinit_keytab
</code_context>
<issue_to_address>
**issue:** The new `is_ipa_configured` import path may break client‑only environments where `ipaserver` is not available.

The previous implementation had a final local fallback for `is_ipa_configured`, so the module still worked when `ipaserver` wasn’t installed (e.g., client‑only setups). The new approach assumes either `ipalib.facts` or `ipaserver.install.installutils` is present and will raise ImportError at import time if both are missing.

If client‑only usage is still required, please add a final fallback implementation or explicit error handling (e.g., degrade gracefully or raise a clear, intentional exception).
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[varunmylaraiah]

@t-woerner I used Rafael’s Code-reviewer Claude skill to review this PR. Here is the review summary.

1. Remove unused IPA_PYTHON_VERSION computation (lines 99-106)

• Not included in __all__ and not used anywhere in plugins/
• Only needed in role modules where it is already exported.
• Keep the NUM_VERSION import, but remove this computation block

**2. Remove duplicate VERSION import on (line 125 )

• Already imported on line 97 with NUM_VERSION

Optional: Enhance error message

</>python
raise RuntimeError("freeipa version '%s' is too old, minimum required is 4.6.8" % VERSION)

Notes:

• The RuntimeError pattern matches existing code in
  • ansible_ipa_client.py:327
  • ansible_ipa_server.py:229
  • ansible_ipa_replica.py:200
• Security: Removing fallbacks reduces attack surface and avoids drift from upstream IPA
• The is_ipa_configured change only affects EOL distros (RHEL 7, early RHEL 8) with client-only installations

[rjeffman]

Shouldn't the README files also note that the minimum supported version is now 4.6.8? Currently we have 4.4.0.

(Yes, this was assisted by Claude. Why not?)

[rjeffman]

It would be better to have # IPA < 4.8.9.

[rjeffman]

Wouldn't this require ipaserver to be available, which is not the case in clients, for everything from 4.6.x to 4.8.9?

Here's the agent analysis (which I agree):

On client-only nodes running IPA 4.6.8-4.8.8 (no ipaserver package), the removal of the sysrestore fallback for is_ipa_configured causes the entire module import to fail.

[rjeffman]

Due to the inclusion of from ipapython.version import NUM_VERSION, VERSION (line 97), this becomes a duplicate import.