Bug 32186 - 98univention-squid-samba4.inst always fails on s3 slave in mixed s3/s4 environments
98univention-squid-samba4.inst always fails on s3 slave in mixed s3/s4 enviro...
Status: CLOSED FIXED
Product: UCS@school
Classification: Unclassified
Component: Proxy services
UCS@school 3.1 R2
Other Linux
: P5 normal (vote)
: UCS@school 3.1 R2 Errata
Assigned To: Felix Botner
Erik Damrose
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-08 08:36 CEST by Sönke Schwardt-Krummrich
Modified: 2013-10-07 20:17 CEST (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sönke Schwardt-Krummrich univentionstaff 2013-08-08 08:36:54 CEST
Problem:
The joinscript 98univention-squid-samba4.inst does not get marked as "executed successfully" on samba3-dc-slaves in a samba3-samba4-mixed-environment.

Solution:
98univention-squid-samba4.inst tries to test if the system gets joined into a pure Samba3 domain (respectively the system is able to reach any Samba 4 pdc).

## look for S4 Connector hosts to add the servicePrincipalName to the directory object
s4connectorservicehosts="$(univention-directory-manager computers/computer list "$@" --filter "(univentionService=S4 Connector)" | sed -ne 's|^DN: cn=\([^,]*\).*|\1|p')"

This fails on DC slaves in an UCS@school environment. By passing join credentials to udm, all available s4 pdcs are found within ucs domain. In UCS@school the slave should only look within local LDAP directory for "samba4 capable" systems.

→ replace "udm" with appropriate "ldapsearch" call agains "local" LDAP 
  (→ ldap/server/name)
  This way, in UCS@school the slave is only able to find himself or the dc master.
Comment 1 Felix Botner univentionstaff 2013-09-27 12:14:38 CEST
replaced udm with univention-ldapsearch

univention-squid-kerberos:
ucsschool-3.1-R2: 2.1.0-2.11.201309271051
ucs-3.2-0: 3.0.2-1.12.201309271205

changelog:
changelog-ucsschool-3.1R2-2.tex
changelog-3.2.xml

removed branches/ucs-3.2/ucs-school-3.2/univention-squid-kerberos
Comment 2 Erik Damrose univentionstaff 2013-09-30 16:01:48 CEST
OK: Code functionality
OK: Change applied to univention-squid-kerberos ucs@school 3.1-R2: 2.1.0-2.11.201309271051
OK: package univention-squid-kerberos removed from ucs-school-3.2
OK: Change applied to univention-squid-kerberos in ucs-3.2-0: 3.0.2-1.12.201309271205

OK: Changelog entry for ucs@school 3.1-R2-2, ucs-3.2-0
-> Verified
Comment 3 Sönke Schwardt-Krummrich univentionstaff 2013-10-07 20:17:56 CEST
UCS@school 3.1 R2-2 has been released:
http://download.univention.de/doc/release-notes-ucsschool-3.1-rev2-2.pdf

If this error occurs again, please use "Clone This Bug".