When we are adding a user with user-add command, post callback makes it a member of ipausers group. However, when user for example also has an automember rule or default group configured to make all new users members of ipausers group, user-add will end with error:

# ipa user-add b
First name: b
Last name: b
ipa: ERROR: This entry is already a member

user-add post-callback should just catch AlreadyGroupMember exception raised by ldap.add_entry_to_group(dn, group_dn) and continue.