WordPress Cronjob Oddities

Question

WordPress v6.1.1 CiviCRM v5.59.2

So, my cronjob appears to work; however, there are some oddities in how it works and there are errors picked up in the email that is delivered.

The oddities are as follows and change up about every 12 hours with no rhyme or reason:

1. Processed as Activity: Drivers Can Be Contractors: Calif. Panel Mostly Backs Prop 22
2. Processed as Activity: No Retrial For Weinstein On LA Sex Assault Counts
3. Processed as Activity: Security alert for [email protected]

Now, I am in shared hosting on Business Cloud wherein, I have several websites. With respect to #3, it is citing my foreclosurepedia.org website (and email address).

I also have two errors for jobs. One is for scheduled emails and the other is for SMS, that we have never used.

1. Finished execution of Send Scheduled Mailings with result: Failure, Error message: API permission check failed for Group/get call; insufficient permission: require access CiviCRM

2. Finished execution of Send Scheduled SMS with result: Failure, Error message: API permission check failed for Group/get call; insufficient permission: require access CiviCRM

Below is the cronjob set up for cPanel. The user is an Editor not an Admin in the WordPress hierarchical roles using the WordPress ACL. (I can change it to Administrator, but seems scary as having multiple administrators isn't the best way.) It is set up to run every hour. It updates all of the Scheduled Jobs other than the two errors and those just happened 19MAR23.

Cron xxx@xx wget -O - -q -t 1 'https://www.iafst.org/wp-content/plugins/civicrm/civicrm/bin/cron.php?name=username&pass=password&key=key' --- it has a second ' at the end as it is required for cPanel.

Also, would the errors about the API permission check occur because we are on MariaDB v10.6.11, which is similar to MySQL 8.0. I found an article that stated MySQL v8 triggers connection errors due to how MySQL 8 defaults to auth_socket connections. I am guessing that by executing ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'password'; fix this?

Added on 19MAR23 at 1439EDT: So, the Cronjob appears to be happy as it says: Cron Running OK Last cron run at March 19th, 2023 2:00 PM. The errors are gone. All I did was utilize the WordPress ACL and create the CiviCRM Admin Role and assign it to the cronuser. Does this mean I no longer have to mess with the MySQL change cited in the article below (which is MariaDB on my side)? Thanx!

Article located here IN RE: Last paragraph.

Answer 1

The permissions that your scheduled job runner needs depends on what permissions are needed for the jobs you have selected to be run. If Job A requires permissions 1 and 2, and Job B requires permission 3 and you do a typical cv api Job.execute to run them, then your user needs permissions 1,2 & 3 etc.

However, most jobs don't clearly identify what permissions they need making it hard to know what to specify. On top of that, the documentation writers obviously don't know what combination of jobs you are going to enable - so the documentation is not going to tell you a minimum set of permissions.

Generally the cron user is set up as admin so it has full access to everything it might need. The list of what jobs are run is managed by admins.

If you have separate cron entries for specific jobs (eg cv api Job.mail_report) you could try to identify the minimum set of permissions needed and configure a cron user with that - but if you also have a generic admin user for other jobs, it is not clear what the benefit is.

I do agree the documentation at https://docs.civicrm.org/sysadmin/en/latest/setup/jobs/#choosing-a-cms-user could be more helpful. It says the user needs 'correct permissions' but does not suggest how you might figure that out. Maybe when you have got things working you could improve that section?

Answer 2

The errors have stopped and the cronjob now functions properly. The only thing I did different was create the CiviCRM Admin Role and apply it through the WordPress ACL feature. It solved the error for API issues and appears to have cleared up the errors via email. I cannot comment on whether the cronuser account could be set at a lower level than CiviCRM Admin Role as it is beyond my knowledge. I can say that the cronuser inside of WordPress is set to Subscriber. Honestly, since so many folks have problems with this (I put it off for nearly 5 years now) I would have thought someone would have spelled out IN CLEAR AND PRECISE TERMS, what roles were necessary to assign to kick off the Scheduled Jobs. If anyone might know the answer I would BE GREATLY APPRECIATIVE!

Here is the document discussing it all:

https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/