I created and configured a test-environment of 3 virtual machines:
A FreeIPA server which provides krb5-authentication
A NFS-Server using server 1 to secure itself
A client that automounts home directories from the nfs server
The problem is, that when i add a user to my kerberos domain (using the FreeIPA webinterface in this case) i still have to connect to the fileserver to create a home directory for the user. Admittedly this is a simple process but it adds complexity to the process of user creation and makes it impossible for me to delegate the task to non-technical people because i'd have to grant them access to the fileserver.
My first idea was to create a cronjob that fetches the user list and creates missing homes. Problem is that this leaves a timeframe after creation where the account is not working which is bound to cause trouble.
What is the best practice to automatically create user specific directories (homes) on a standalone NFS-Server?
Here are a few ways of doing this but I'd shy away from using the term "best practice".
This will work - I've done it before. Why wouldn't it work? Make it run periodically during business hours and warn new users that their account will be ready for use after X minutes.
Properly centralise account management
Create a script/interface that uses the IPA commands, adds home directories and whatever else (eg mailbox) on a secure management server, rather than doing it manually via the gui. This is the option i would suggest if you have the resources.
Use a "first login" terminal
Create a dedicated secure workstation (if users are all in close proximity) or server for users to log in for the first time, using jordanm's setup to automatically create a home dir.
One solution to this issue is to use pam_mkhomedir to create their home directory on their first login to a system. The description in the manpage:
The pam_mkhomedir PAM module will create a users home directory if it
does not exist when the session begins. This allows users to be
present in central database (such as NIS, kerberos or LDAP) without
using a distributed file system or pre-creating a large number
of directories. The skeleton directory (usually /etc/skel/) is used
to copy default files and also sets a umask for the creation.