Attachment 5236 Details for Bug 31437

concept for this change.

create_EDC.txt (text/plain), 2.87 KB, created by Arvid Requate on 2013-05-23 23:43 CEST

(hide)

Description:

Filename:

MIME Type:

Creator: Arvid Requate

Created: 2013-05-23 23:43 CEST

Size: 2.87 KB

patch

obsolete

>1. Update for ucs-school-single-master / ucs-school-master and normal UCS Master / Backup (all with samba4)
>
>  * Problem: there is no Samba4 specific package in UCS@school Master / Backup where we could increase
>    the joinscript version
>
>  * Instead the steps are done via an Errata update for the normal UCS
>
>  * To avoid increasing the joinscript-version in an errata update, the steps are done in univention-s4-connector.postinst:
>
>  * append 'Enterprise Domain Controllers' to 'connector/s4/mapping/group/ignorelist'
>    on all hosts having the univention-s4-connector package installed.
>	restart s4-connector afterwards.
>
>  * If Master or Backup run the real S4 Connector create the group and add all currently registered Samba4 DCs to it (univention-samba4/scripts/create_group_Enterprise_Domain_Controllers.py)
>
>  * wait for samba4-idmap and run samba-tool ntacl sysvolreset
>
>2. On UCS@school 3.1 R2 Slaves the group creation and sysvolreset is done via the join script 98univention-samba4slavepdc-dns.inst (from univention-ldb-modules) (++VERSION). This way,even if there is no Samba4 on the Master / Backup we still can create the group (with the given Administrator credentials), wait for the samba4-idmap listener and perform the sysvolreset.  (separate Bug #31438)
>
>  * In this case 'Enterprise Domain Controllers' has already been appended to 'connector/s4/mapping/group/ignorelist' by univention-s4-connector.postinst, S4 connector has been restarted.
>
>  * Create group and add all currently registered Samba4  DCs to it (univention-samba4/scripts/create_group_Enterprise_Domain_Controllers.py)
>
>  * wait for samba4-idmap and run samba-tool ntacl sysvolreset
>
>3. Errata for UCS@school Slaves is handled in univention-s4-connector.postinst:
>
>  * append 'Enterprise Domain Controllers' to 'connector/s4/mapping/group/ignorelist'
>    on all hosts having the univention-s4-connector package installed.
>	restart s4-connector afterwards.
>
>  * In case the Master holds Samba4 and is errata-updated before the slaves, we probably have a reject in the S4 Connector on the UCS@school Slave due to the objectSid conflict with the exisiting foreignSecurityPrincipal object. We simply remove this reject in the postinst.
>
>4. New Installations are handled in the Join script 97univention-s4-connector.inst:
>
>  * append 'Enterprise Domain Controllers' to 'connector/s4/mapping/group/ignorelist'
>    on all hosts having the univention-s4-connector package installed.
>	restart s4-connector afterwards.
>
>  * If the system runs a S4 Connector try to create the group and add all currently registered Samba4 DCs to it (univention-samba4/scripts/create_group_Enterprise_Domain_Controllers.py)
>
>  * wait for samba4-idmap
>
>  * In this case "samba-tool ntacl sysvolreset" is run by 98univention-samba4-dns.inst later, so we skip this step here.
>
>5. New installed Samba4 DCs add themselves to the new group via Join script 96univention-samba4.inst
>

Actions: View

Attachments on bug 31437: 5236