Bug 51975 – *univention-radius.acl uses "cn=Domain Admins" instead of content of UCR var groups/default/domainadmins

Bug 51975 - *univention-radius.acl uses "cn=Domain Admins" instead of content of UCR var groups/default/domainadmins


Summary:	*univention-radius.acl uses "cn=Domain Admins" instead of content of UCR var ...

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	LDAP
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2020-09-09 11:18 CEST by Julia Bremer
Modified:	2020-09-22 11:51 CEST (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	Bug Report
What type of bug is this?:	3: Simply Wrong: The implementation doesn't match the docu
Who will be affected by this bug?:	1: Will affect a very few installed domains
How will those affected feel about the bug?:	2: A Pain – users won’t like this once they notice it
User Pain:	0.034
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Julia Bremer

2020-09-09 11:18:28 CEST

The files 
services/univention-radius/usr/share/univention-radius/66univention-radius.acl
and 
services/univention-radius/usr/share/univention-radius/59univention-radius.acl
use hardcoded cn=Domain Admins,cn=groups,$(ldap/base) in the ACLs instead of the content of the UCR Variable groups/default/domainadmins. 

This means that the ACLs will not be updated if the name of the "Domain Admin" group is changed for example in AD Membermode. 

The ucs-test 01_base/96rename_domain_admins therefore fails.

http://jenkins.knut.univention.de:8080/job/UCS-4.4/job/UCS-4.4-5/job/AutotestJoin/lastCompletedBuild/SambaVersion=no-samba,Systemrolle=master/testReport/01_base/96rename_domain_admins/master090/

Comment 1 Julia Bremer

2020-09-10 10:32:19 CEST

I added a workaround so that the test doesn't fail constantly:

1aff5be60b506ff98285e9d6ceae3d15c26bf198