Bug 54038 – Fix Joinscript idempotence: Kerberos-based SAML-SSO is not working for Windows clients joined to a UCS@school schoolserver

Bug 54038 - Fix Joinscript idempotence: Kerberos-based SAML-SSO is not working for Windows clients joined to a UCS@school schoolserver


Summary:	Fix Joinscript idempotence: Kerberos-based SAML-SSO is not working for Window...

Status:	NEW

Product:	UCS@school
Classification:	Unclassified
Component:	General
Version:	UCS@school 5.0
Hardware:	Other All

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS@school maintainers
QA Contact:

URL:
Keywords:

Depends on:	51078
Blocks:
	Show dependency tree / graph

Reported:	2021-11-09 09:51 CET by Erik Damrose
Modified:	2022-11-09 11:31 CET (History)
CC List:	7 users (show)

See Also:	55403
What kind of report is it?:	Bug Report
What type of bug is this?:	5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?:	1: Will affect a very few installed domains
How will those affected feel about the bug?:	2: A Pain – users won’t like this once they notice it
User Pain:	0.057
Enterprise Customer affected?:
School Customer affected?:	Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Erik Damrose

2021-11-09 09:51:54 CET

At the original bug a fix was implemented to add a servicePrincipalName to the ucs-sso user on school replica servers. However, there is a check around that functionality:
if [ $JS_LAST_EXECUTED_VERSION -lt 5 ]; then ...

Simply re-executing the joinscript will not fix the missing SPN issue if present. The check should be removed.

62ucs-school-nonedu-slave.inst
62ucs-school-slave.inst

+++ This bug was initially created as a clone of Bug #51078 +++