Bug 36980 – sync ntSecurityDescriptor of groupPolicyContainer objects

Bug 36980 - sync ntSecurityDescriptor of groupPolicyContainer objects


Summary:	sync ntSecurityDescriptor of groupPolicyContainer objects

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	S4 Connector
Version:	UCS 4.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.0-0-errata
Assigned To:	Arvid Requate
QA Contact:	Stefan Gohmann

URL:
Keywords:

Depends on:	36979
Blocks:
	Show dependency tree / graph

Reported:	2014-11-24 19:40 CET by Arvid Requate
Modified:	2015-01-22 11:56 CET (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2014-11-24 19:40:18 CET

Also for errata4.0-0


+++ This bug was initially created as a clone of Bug #33768 +++

For a proper sysvol synchronization, we need to sync the ntSecurityDescriptor (the acl's for the gpo) for gpo objects.

This is especially necessary for ucs@school environments, because here gpo objects are replicated to the domain dc's via s4connector|UCS ldap replication (not by drs replication).

Comment 1 Arvid Requate

2014-11-27 18:31:21 CET

Fixed.
Testcase: 52_s4connector/100sync_gpo_ntsecurity_descriptor
Advisory: 2014-11-27-univention-s4-connector.yaml

Comment 2 Stefan Gohmann

2014-12-11 07:45:53 CET

YAML: OK

Code review: OK
 You can now add filters to resync_object_from_s4.py. But the tool doesn't check if the object will be synced. This will caused errors like this:

25.11.2014 08:03:41,572 LDAP        (ERROR  ): sync of rejected object failed
        CN=ipsecNegotiationPolicy{72385233-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,DC=deadlock40,DC=intranet
25.11.2014 08:03:41,572 LDAP        (ERROR  ): Traceback (most recent call last):
  File "/usr/lib/pymodules/python2.7/univention/s4connector/s4/__init__.py", line 2055, in resync_rejected
    sync_successfull = self.sync_to_ucs(property_key, mapped_object, premapped_s4_dn, object)
  File "/usr/lib/pymodules/python2.7/univention/s4connector/__init__.py", line 1326, in sync_to_ucs
    if self.property[property_type].sync_mode in ['write', 'none']:
KeyError: None

Test case: OK

Test UCS upgrade: OK

Test UCS new installation: OK

Test UCS@school upgrade: OK

Test UCS@school installation: OK

Comment 3 Arvid Requate

2014-12-15 17:23:13 CET

> As discussed, maybe we sync the ntSecurityDesciptor in @school setups only.

Code and advisory have been updated. There is a new errata bug for UCS@schoool 4.0 to activate synchronization.

Comment 4 Stefan Gohmann

2015-01-20 13:12:15 CET

(In reply to Arvid Requate from comment #3)
> > As discussed, maybe we sync the ntSecurityDesciptor in @school setups only.
> 
> Code and advisory have been updated. There is a new errata bug for
> UCS@schoool 4.0 to activate synchronization.

That's Bug #37350.

Code review: OK

Tests: OK

Comment 5 Janek Walkenhorst

2015-01-22 11:56:56 CET

<http://errata.univention.de/ucs/4.0/42.html>