<div dir="ltr">Hi,<div>we needed something similar, calling script for adding/removing VPN users via SSH commands.</div><div>So far we ended with calling SSH directly on model hook level.</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><p><span style="font-family:Arial,sans-serif;font-size:10pt">--</span></p><p><span style="font-family:Arial,sans-serif;font-size:10pt">s pozdravem</span></p><table style="font-family:Verdana,Arial,Helvetica,sans-serif;border-collapse:collapse;padding:0px;margin:0px;border-width:0px!important;border-style:solid!important;width:482px!important"><tbody><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px;width:160px;vertical-align:bottom;padding:0px;border:0px solid gray!important"><p><span style="font-size:14px;font-weight:bold">Petr Gašparík</span><br>solution architect<br><br>gsm: [+420] 603 523 860<br>e-mail: <a href="mailto:petr.gasparik@ami.cz" target="_blank">petr.gasparik@ami.cz</a></p></td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;border-right-width:1px;border-right-style:solid;border-right-color:rgb(204,204,204);padding:0px;border-top-width:0px!important;border-bottom-width:0px!important;border-left-width:0px!important;border-top-style:solid!important;border-bottom-style:solid!important;border-left-style:solid!important;border-top-color:gray!important;border-bottom-color:gray!important;border-left-color:gray!important"> </td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;border:0px solid gray!important"> </td><td style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px;vertical-align:bottom;padding:0px;width:123px;border:0px solid gray!important"><p>AMI Praha a.s.<br>Pláničkova 11<br>162 00 Praha 6<br>tel.: [+420] 274 783 239<br>web: <a href="http://www.ami.cz/" target="_blank">www.ami.cz</a></p></td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;border-right-width:1px;border-right-style:solid;border-right-color:rgb(204,204,204);padding:0px;border-top-width:0px!important;border-bottom-width:0px!important;border-left-width:0px!important;border-top-style:solid!important;border-bottom-style:solid!important;border-left-style:solid!important;border-top-color:gray!important;border-bottom-color:gray!important;border-left-color:gray!important"> </td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;border:0px solid gray!important"> </td><td style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px;margin:8px;border:0px solid gray!important;width:116px"><p><img src="http://www.ami.cz/images/podpis/ami_logo.gif" alt="AMI Praha a.s." style="border:0px"></p></td></tr><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="7" style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;width:480px;border:0px solid gray!important"><br><a href="http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/audit-roli-a-opravneni-sap" target="_blank"><img src="http://www.ami.cz/images/podpis/AMI-podpis-AuditSAP_1.gif" alt="AMI Praha a.s." style="border:0px;width:480px!important;height:82px!important"></a></td></tr><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="7" style="color:rgb(128,128,128);font-family:Arial,sans-serif;font-size:11px;padding:0px;border:0px solid gray!important"><br>Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.<br><br></td></tr></tbody></table></div></div></div>
<br><div class="gmail_quote">2016-12-22 13:09 GMT+01:00 Radovan Semancik <span dir="ltr"><<a href="mailto:radovan.semancik@evolveum.com" target="_blank">radovan.semancik@evolveum.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
Yes. And that would be actually the right place to do it. We have taken the Unix connector from the ConnId project and we have significantly improved it. And contributed the changes back to ConnId project. You can do the same thing and implement the scripting support there.<span class="im HOEnZb"><br>
<br>
-- <br>
Radovan Semancik<br>
Software Architect<br>
<a href="http://evolveum.com" rel="noreferrer" target="_blank">evolveum.com</a><br>
<br>
<br>
<br></span><div class="HOEnZb"><div class="h5">
On 12/22/2016 12:12 PM, Wojciech Staszewski wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Thank you for your answer.<br>
<br>
Adding scripting support for Unix connector would be nice too.<br>
I have several dozens of servers hosting virtual machines (proxmox VE).<br>
Users allowed to manage virtual machines must be added by running shell command "pveum useradd $user@pam && pveum aclmod / -user $user@pam -role Administrator".<br>
And deleting users in the same way.<br>
Unfortunately Unix connector can't execute scripts, so it must be done by workaround (i'm thinking right now how to do it).<br>
<br>
Greets!<br>
WS<br>
<br>
W dniu 22.12.2016 o 11:28, Radovan Semancik pisze:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I think you already know the answer: there is no good way how to do this now. However, there are two options for future midPoint development:<br>
<br>
1) Add ssh scripting support to the LDAP connector. This should be quite simple. And there is a precedent for this. The LDAP-based AD connector (which is in the same bundle) already has powershell scripting support. This is quite easy and very practical solution. Yet the application is somehow limited.<br>
<br>
2) Implement a way how to use scripting methods from one resource in another resource. The ConnId script execution operations are not bound to any account or provisioning operation. So this is theoretically possible. However, midPoint was designed with good interface design and encapsulation in mind and this is currently not directly possible. However it can be added if needed - and it would still be quite clean. This would be nice and generic feature. E.g. it could be used to combine CSV<br>
connector with ssh scripts (from Unix connector) to copy the file from remote server - and this could do a lot of interesting tricks.<br>
<br>
As usual, these are the options: <a href="https://wiki.evolveum.com/display/midPoint/I+Need+New+Feature" rel="noreferrer" target="_blank">https://wiki.evolveum.com/disp<wbr>lay/midPoint/I+Need+New+Featur<wbr>e</a><br>
<br>
We are now preparing development plan for midPoint 3.6. It looks like there will be a lot of sponsored features and the development team will be very busy. But some sponsoring is still not confirmed so there may still be some place in the plan. First come, first serve.<br>
<br>
</blockquote>
______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
</blockquote>
<br>
<br>
______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
</div></div></blockquote></div><br></div>