We need a login script that creates a univention.environment (environment file for pam_env) from the users "environment variables" policy.
lightdm login scripts are executed to late for pam_env. We need to run the script in the pam stack. (1) in /etc/pam.d/lightdm (before common-session) /usr/sbin/univention-ucc-fetch-policies is executed with pam_runasroot (2) /usr/sbin/univention-ucc-fetch-policies creates an environment file (~/.ucc-environment) from the users "univentionCorporateClientDesktopEnv" policy settings (3) in /etc/pam.d/common-session pam_env is executed with ~/.ucc-environment as environment file New environment variable for users should be available after the next lightdm login