Package: ipa-notify
FreeIPA NotificationNotify IPA Users for password expiration and locked users to adminRequired packages:krb5-develpython3-pippython3-virtualenv (Optional)Create a new role for notifieriparole-add--desc"Notification agent role""Notification Agent"Add privileges to the roleiparole-add-privilege"Notification Agent"--privileges="User Administrators"iparole-add-privilege"Notification Agent"--privileges="Group Administrators"iparole-add-privilege"Notification Agent"--privileges="Password Policy Readers"Create a new service and assign the role to this serviceipaservice-addNOTIFY/ipa1.example.com
iparole-add-member"Notification Agent"--services="NOTIFY/ipa1.example.com@EXAMPLE.COM"ipaservice-allow-retrieve-keytab"NOTIFY/ipa1.example.com@EXAMPLE.COM"--hosts=ipa1.example.comObtain a keytab with fix permissionsipa-getkeytab-sipa1.example.com-p"NOTIFY/ipa1.example.com@EXAMPLE.COM"-k~/.priv/notify.keytab
chmod-R600~/.priv(Optional) Create a new virtual env and activate itmkdir/opt/ipa-notify
virtualenv-ppython3/opt/ipa-notify/venvsource/opt/ipa-notify/venv/bin/activateInstall this package:pip3installipa-notifyRun the command innoopmode for a successful user listing/opt/ipa-notify/bin/ipa-notify--serveripa1.example.com-p"NOTIFY/ipa1.example.com@EXAMPLE.COM"-k~/.priv/notify.keytab\--limit10--groupsusers--check-expiration--noopCreate a script includes the command with your parameters with proper permissions under/usr/local/sbin/Add a crontab entry. For example0 0 *  *  * root /usr/local/sbin/ipa_notify.sh &>> /var/log/ipa_notify.log(Optional) You can create an email template folder and overwrite the message content. You can change the content but
do not change file names or variable names. Template should start withSubject:keyword and there has to be new
line between the subject and body. Please test your template before using.$python3-c'import ipa_notify;print(ipa_notify.__file__)'/usr/local/lib/python3.6/site-packages/ipa_notify/__init__.py
$cp-r/usr/local/lib/python3.6/site-packages/ipa_notify/templates./mytemplates# edit the content$ipa-notify...--templates./mytemplatesParameters:$ipa-notify--help
usage:ipa-notify[-h][--serverSERVER][--verify-ssl][--no-verify-ssl][--principalPRINCIPAL][--keytabKEYTAB][--groupsGROUPS[GROUPS...]][--limitLIMIT][--smtp-hostSMTP_HOST][--smtp-portSMTP_PORT][--smtp-security{none,STARTTLS,SSL}][--smtp-userSMTP_USER][--smtp-passSMTP_PASS][--smtp-fromSMTP_FROM][--adminsADMINS[ADMINS...]][--noop][--check-expiration][--check-locked][--templatesTEMPLATES][--log-level{CRITICAL,FATAL,ERROR,WARN,WARNING,INFO,DEBUG,NOTSET}]IPANotifier

optionalarguments:-h,--helpshowthishelpmessageandexit--serverSERVERipaserverfqdn(default:ipa.domain.com)--verify-sslverifyipaconnectionSSLcert(default)(default:True)--no-verify-ssldonotverifyipaconnectionSSLcert(default:True)--principalPRINCIPALuserprincipalforkerberosauthentication(default:admin@DOMAIN.COM)--keytabKEYTABkeytabpath(default:/tmp/user.kt)--groupsGROUPS[GROUPS...]listofusergroupstocheck(default:['users'])--limitLIMITnumberofdaysbeforenotifyingauser(default:5)--smtp-hostSMTP_HOSTsmtphostforsendingemail(default:localhost)--smtp-portSMTP_PORTsmtpportforsendingemail(default:25)--smtp-security{none,STARTTLS,SSL}smtpportforsendingemail(default:none)--smtp-userSMTP_USERsmtpuserlogin(default:)--smtp-passSMTP_PASSsmtpuserpassword(default:)--smtp-fromSMTP_FROMsmtpfromemailaddress(default:noreply@domain.com)--adminsADMINS[ADMINS...]adminuser(s)email(s)tonotifyaboutlockedusers(default:admin@domain.com)--noopnooperationmode.Donotsendemails(default:False)--check-expirationCheckpasswordexpirationsforusers(default:False)--check-lockedChecklockedoutusers(default:False)--templatesTEMPLATESCustomemailtemplatefolder(default:)--log-level{CRITICAL,FATAL,ERROR,WARN,WARNING,INFO,DEBUG,NOTSET}loglevel(default:INFO)