[Freeipa-users] user-custom script

[Sigbjorn Lie]

Hi,

A while back I got some help writing a python script who extends the user classes in ipalib to run
a custom command when a user is added/modified/deleted. This has been working perfectly in our
production environment for a few years now, until I upgraded to IPA 3.0 last week. The custom
script is no longer executed.

Did the libraries change since 2.2?


The script sits in /usr/lib/python2.6/site-packages/ipalib/plugins/user-custom.py and looks like:


#
# Extension to provide user-customizable script when a user id added/modified/deleted
#

from ipapython import ipautil

# Extend add

from ipalib.plugins.user import user_add

def script_post_add_callback(inst, ldap, dn, attrs_list, *keys, **options):
inst.log.info('User added')
if 'ipa_user_script' in inst.api.env:
try:
ipautil.run([inst.api.env.ipa_user_script,"add", dn])
except:
pass

return dn

user_add.register_post_callback(script_post_add_callback)


# Extend delete

from ipalib.plugins.user import user_del

def script_post_del_callback(inst, ldap, dn, attrs_list, *keys, **options):
inst.log.info('User deleted')
if 'ipa_user_script' in inst.api.env:
try:
ipautil.run([inst.api.env.ipa_user_script,"del", dn])
except:
pass

return dn

user_del.register_post_callback(script_post_del_callback)


# Extend modify

from ipalib.plugins.user import user_mod

def script_post_mod_callback(inst, ldap, dn, attrs_list, *keys, **options):
inst.log.info('User modified')
if 'ipa_user_script' in inst.api.env:
try:
ipautil.run([inst.api.env.ipa_user_script,"mod", dn])
except:
pass

return dn

user_mod.register_post_callback(script_post_mod_callback)

[Martin Kosek]

Post by Sigbjorn Lie
Hi,
A while back I got some help writing a python script who extends the user classes in ipalib to run
a custom command when a user is added/modified/deleted. This has been working perfectly in our
production environment for a few years now, until I upgraded to IPA 3.0 last week. The custom
script is no longer executed.
Did the libraries change since 2.2?
#
# Extension to provide user-customizable script when a user id added/modified/deleted
#
from ipapython import ipautil
# Extend add
from ipalib.plugins.user import user_add
inst.log.info('User added')
ipautil.run([inst.api.env.ipa_user_script,"add", dn])
pass
return dn
user_add.register_post_callback(script_post_add_callback)
# Extend delete
from ipalib.plugins.user import user_del
inst.log.info('User deleted')
ipautil.run([inst.api.env.ipa_user_script,"del", dn])
pass
return dn
user_del.register_post_callback(script_post_del_callback)
# Extend modify
from ipalib.plugins.user import user_mod
inst.log.info('User modified')
ipautil.run([inst.api.env.ipa_user_script,"mod", dn])
pass
return dn
user_mod.register_post_callback(script_post_mod_callback)

Hello Signbjorn,

There were changes related to callback registration in 3.0:
https://fedorahosted.org/freeipa/ticket/2674

Adding Petr Viktorin to CC to advise how to fix this issue.

Martin

[Petr Viktorin]

Post by Sigbjorn Lie
Hi,
A while back I got some help writing a python script who extends the user classes in ipalib to run
a custom command when a user is added/modified/deleted. This has been working perfectly in our
production environment for a few years now, until I upgraded to IPA 3.0 last week. The custom
script is no longer executed.
Did the libraries change since 2.2?

Hello,
Yes, IPA did change, though not in the callback registration API. See
comment below.

Post by Sigbjorn Lie
#
# Extension to provide user-customizable script when a user id added/modified/deleted
#
from ipapython import ipautil
# Extend add
from ipalib.plugins.user import user_add
inst.log.info('User added')
ipautil.run([inst.api.env.ipa_user_script,"add", dn])
pass

First of all, you can add better logging so you can diagnose errors more
easily, e.g.:

try:
ipautil.run([inst.api.env.ipa_user_script,"add", dn])
except Exception, e:
inst.log.error("ipa_user_script: Exception: %s", e)

With this change, I can see the following line in the server log:

ipa: ERROR: ipa_user_script: Exception: sequence item 2: expected string
or Unicode, DN found

The error is due to DN refactoring
(https://fedorahosted.org/freeipa/ticket/1670). All DNs throughout IPA
are now represented by DN objects. To use them as strings you need to
convert them explicitly:

ipautil.run([inst.api.env.ipa_user_script, "add", str(dn)])

The same change is needed in the other three cases.
The modified code should still work under IPA 2.2.
Let me know if you're having more trouble.

Post by Sigbjorn Lie
return dn
user_add.register_post_callback(script_post_add_callback)
# Extend delete
from ipalib.plugins.user import user_del
inst.log.info('User deleted')
ipautil.run([inst.api.env.ipa_user_script,"del", dn])
pass
return dn
user_del.register_post_callback(script_post_del_callback)
# Extend modify
from ipalib.plugins.user import user_mod
inst.log.info('User modified')
ipautil.run([inst.api.env.ipa_user_script,"mod", dn])
pass
return dn
user_mod.register_post_callback(script_post_mod_callback)

[Sigbjorn Lie]

Post by Petr Viktorin

Post by Sigbjorn Lie
Hi,
A while back I got some help writing a python script who extends the user classes in ipalib to
run a custom command when a user is added/modified/deleted. This has been working perfectly in
our production environment for a few years now, until I upgraded to IPA 3.0 last week. The
custom script is no longer executed.
Did the libraries change since 2.2?

Hello,
Yes, IPA did change, though not in the callback registration API. See
comment below.

Post by Sigbjorn Lie
The script sits in /usr/lib/python2.6/site-packages/ipalib/plugins/user-custom.py and looks
#
# Extension to provide user-customizable script when a user id added/modified/deleted
#
from ipapython import ipautil
# Extend add
from ipalib.plugins.user import user_add
def script_post_add_callback(inst, ldap, dn, attrs_list, *keys, **options): inst.log.info('User
pass

First of all, you can add better logging so you can diagnose errors more
inst.log.error("ipa_user_script: Exception: %s", e)
ipa: ERROR: ipa_user_script: Exception: sequence item 2: expected string
or Unicode, DN found
The error is due to DN refactoring
(https://fedorahosted.org/freeipa/ticket/1670). All DNs throughout IPA
ipautil.run([inst.api.env.ipa_user_script, "add", str(dn)])
The same change is needed in the other three cases.
The modified code should still work under IPA 2.2.
Let me know if you're having more trouble.

Post by Sigbjorn Lie
return dn
user_add.register_post_callback(script_post_add_callback)
# Extend delete
from ipalib.plugins.user import user_del
def script_post_del_callback(inst, ldap, dn, attrs_list, *keys, **options): inst.log.info('User
pass
return dn
user_del.register_post_callback(script_post_del_callback)
# Extend modify
from ipalib.plugins.user import user_mod
def script_post_mod_callback(inst, ldap, dn, attrs_list, *keys, **options): inst.log.info('User
pass
return dn
user_mod.register_post_callback(script_post_mod_callback)

Thank you.

I removed the user-custom.pyc, and moved the existing user-custom.py file to /root and made the
changes in a new file, user-custom-v3.py. I then restarted httpd. However a .pyc file is not
created, even after adding/removing/modifying a user.

And the command specified to run in ipa_user_script is not run.

Do you have a suggestions to what I might be doing wrong?


Regards,
Siggi

[Petr Viktorin]

Post by Sigbjorn Lie

Post by Petr Viktorin

Post by Sigbjorn Lie
Hi,
A while back I got some help writing a python script who extends the user classes in ipalib to
run a custom command when a user is added/modified/deleted. This has been working perfectly in
our production environment for a few years now, until I upgraded to IPA 3.0 last week. The
custom script is no longer executed.
Did the libraries change since 2.2?

Hello,
Yes, IPA did change, though not in the callback registration API. See
comment below.

Post by Sigbjorn Lie
The script sits in /usr/lib/python2.6/site-packages/ipalib/plugins/user-custom.py and looks
#
# Extension to provide user-customizable script when a user id added/modified/deleted
#
from ipapython import ipautil
# Extend add
from ipalib.plugins.user import user_add
def script_post_add_callback(inst, ldap, dn, attrs_list, *keys, **options): inst.log.info('User
pass

First of all, you can add better logging so you can diagnose errors more
inst.log.error("ipa_user_script: Exception: %s", e)
ipa: ERROR: ipa_user_script: Exception: sequence item 2: expected string
or Unicode, DN found
The error is due to DN refactoring
(https://fedorahosted.org/freeipa/ticket/1670). All DNs throughout IPA
ipautil.run([inst.api.env.ipa_user_script, "add", str(dn)])
The same change is needed in the other three cases.
The modified code should still work under IPA 2.2.
Let me know if you're having more trouble.

[...]

Post by Sigbjorn Lie
Thank you.
I removed the user-custom.pyc, and moved the existing user-custom.py file to /root and made the
changes in a new file, user-custom-v3.py. I then restarted httpd. However a .pyc file is not
created, even after adding/removing/modifying a user.

The server runs under apache, it doesn't have permissions to create .pyc
files in /usr/lib/.

Post by Sigbjorn Lie
And the command specified to run in ipa_user_script is not run.
Do you have a suggestions to what I might be doing wrong?

Do you get any messages in /var/log/httpd/error_log?

[Sigbjorn Lie]

Post by Petr Viktorin

Post by Sigbjorn Lie

Post by Petr Viktorin

Post by Sigbjorn Lie
Hi,
A while back I got some help writing a python script who extends the user classes in ipalib
to run a custom command when a user is added/modified/deleted. This has been working
perfectly in our production environment for a few years now, until I upgraded to IPA 3.0
last week. The custom script is no longer executed.
Did the libraries change since 2.2?

Hello,
Yes, IPA did change, though not in the callback registration API. See
comment below.

Post by Sigbjorn Lie
The script sits in /usr/lib/python2.6/site-packages/ipalib/plugins/user-custom.py and looks
#
# Extension to provide user-customizable script when a user id added/modified/deleted
#
from ipapython import ipautil
# Extend add
from ipalib.plugins.user import user_add
ipautil.run([inst.api.env.ipa_user_script,"add", dn]) except: pass

First of all, you can add better logging so you can diagnose errors more
inst.log.error("ipa_user_script: Exception: %s", e)
ipa: ERROR: ipa_user_script: Exception: sequence item 2: expected string
or Unicode, DN found
The error is due to DN refactoring
(https://fedorahosted.org/freeipa/ticket/1670). All DNs throughout IPA
ipautil.run([inst.api.env.ipa_user_script, "add", str(dn)])
The same change is needed in the other three cases.
The modified code should still work under IPA 2.2.
Let me know if you're having more trouble.

[...]

Post by Sigbjorn Lie
Thank you.
I removed the user-custom.pyc, and moved the existing user-custom.py file to /root and made the
changes in a new file, user-custom-v3.py. I then restarted httpd. However a .pyc file is not
created, even after adding/removing/modifying a user.

The server runs under apache, it doesn't have permissions to create .pyc
files in /usr/lib/.

Post by Sigbjorn Lie
And the command specified to run in ipa_user_script is not run.
Do you have a suggestions to what I might be doing wrong?

Do you get any messages in /var/log/httpd/error_log?

I managed to figure this one out. SElinux was causing the issue. Everything worked just fine after
restoring the correct file labels.

Thank you for your help. :)


Regards,
Siggi