10 years ago, a user asked running a custom script on user creation, to take care of disk provisioning. https://freeipa-users.redhat.narkive.com/eSX61h7t/add-user-custom-script Having the same need I found this post, however nothing about the posted plugin seems to currently work. I've determined so far the plugin location moved from ipalib to ipa server. I've changed the class. The logging didn't work, and the passing of 'dn' gave a type error. The minimal version below at least doesn't generate any errors, but also does not run the script (which simple echos output to a /tmp/cxc.log file. I would appreciate any assistance either pointing to an already updated version of this type of plugin, assistance doing so, or someone knowledgable updating it for IPA 4.9.2 /usr/lib/python3.6/site-packages/ipaserver/plugins/cript_post_add_callback.py ``` from ipapython import ipautil from ipaserver.plugins.user import user_add def script_post_add_callback(inst, ldap, dn, attrs_list, *keys, **options): # inst.log.error('User added') # if 'ipa_user_script' in inst.api.env: # try: ipautil.run(['/usr/local/sbin/cxc.sh',"add", "dn"]) # except: # pass return dn ``` /usr/local/sbin/cxc.sh ``` #!/bin/bash echo "Hello, world: $1 $2" >>/tmp/cxc.log ```

On Mon, 26 Jul 2021, Rob Crittenden via FreeIPA-users wrote: > Chris Candreva via FreeIPA-users wrote: >> >> 10 years ago, a user asked running a custom script on user creation, to >> take care of disk provisioning. >> https://freeipa-users.redhat.narkive.com/eSX61h7t/add-user-custom-script >> >> Having the same need I found this post, however nothing about the posted >> plugin seems to currently work. >> >> I've determined so far the plugin location moved from ipalib to ipa >> server. I've changed the class. The logging didn't work, and the passing >> of 'dn' gave a type error. The minimal version below at least doesn't >> generate any errors, but also does not run the script (which simple echos >> output to a /tmp/cxc.log file. >> >> I would appreciate any assistance either pointing to an already updated >> version of this type of plugin, assistance doing so, or someone >> knowledgable updating it for IPA 4.9.2 >> >> >> >> /usr/lib/python3.6/site-packages/ipaserver/plugins/cript_post_add_callback.py >> ``` >> from ipapython import ipautil >> from ipaserver.plugins.user import user_add >> >> def script_post_add_callback(inst, ldap, dn, attrs_list, *keys, **options): >> # inst.log.error('User added') >> # if 'ipa_user_script' in inst.api.env: >> # try: >> ipautil.run(['/usr/local/sbin/cxc.sh',"add", "dn"]) >> # except: >> # pass >> >> return dn >> ``` >> >> /usr/local/sbin/cxc.sh >> ``` >> #!/bin/bash >> >> echo "Hello, world: $1 $2" >>/tmp/cxc.log >> ``` > > This is a very inefficient way to do it as it is going to fork Apache > for each user add. We would still like a messaging system to share this > among other types of messages but it is a significant feature with > relatively low priority. > > Your plugin isn't working because you aren't registering the callback, > among other things. > > This will work. > > from ipapython import ipautil > from ipaserver.plugins.user import user_add > from ipalib import api > import logging > > logger = logging.getLogger(__name__) > > > def script_post_add_callback(self, ldap, dn, attrs_list, *keys, **options): > logger.debug('User added') > # if 'ipa_user_script' in self.api.env: > if True: > try: > ipautil.run(['/usr/local/sbin/cxc.sh', "add", str(dn)]) > except Exception as e: > logger.debug('execution failed with %s', e) > > return dn > > user_add.register_pre_callback(script_post_add_callback) > > Note that Apache has its own private tmp so you'll find the log in > something like > /tmp/systemd-private-b1ed3e9ade6c40d69d5f3913595fa651-httpd.service-PVal2h/tmp/cxc.log > > The plugin executes as the ipaapi so will have limited permissions to do > things. > > For more information on plugins see: > > https://abbra.fedorapeople.org/freeipa-extensibility.html > Rob, Thank you ! I was registering the callback, that was a cut and paste error . The private tmp was my problem at the end. You did clear up the other changes. I had found that page, it is out of date though, and has errors. It still refers to ipalib instead of ipaserver, all the prototypes say "dn." instead of "dn," , and it says "entry_args" is a dictionary, it appears to be of type "LDAPEntry" . Is there a more up to date version, or a way to contribute edits ?