Univention Bugzilla – Bug 40767
Builtin groups should not be selectable as primary groups (or controlable via UCRV)
Last modified: 2019-01-03 07:17:57 CET
currently it is possible to select the buildin group e.g. Nobody as primary group for a user. This causes the user not to be synchronized into samba4 because there is a UCRV setting that prohibits the synchronisation of such groups. This should either not be possible or the visibility of the buildin groups should be controlable via UCRV. 16.02.2016 11:25:23,220 LDAP (PROCESS): sync from ucs: [ user] [ modify] cn=support,cn=users,DC=foo,DC=bar 16.02.2016 11:25:23,227 LDAP (ERROR ): sync_from_ucs: traceback during add object: cn=support,cn=users,DC=foo,DC=bar 16.02.2016 11:25:23,227 LDAP (ERROR ): sync_from_ucs: traceback due to addlist: [('objectClass', ['top', 'user', 'person', 'organizationalPerson']), ('s AMAccountName', [u'support']), (u'displayName', [u'foo Support']), (u'sn', [u'Support']), (u'givenName', [u'foo']), ('primaryGroupID', ['548'])] 16.02.2016 11:25:23,229 LDAP (WARNING): sync failed, saved as rejected /var/lib/univention-connector/s4/1455188216.857015 16.02.2016 11:25:23,229 LDAP (WARNING): Traceback (most recent call last): File "/usr/lib/pymodules/python2.7/univention/s4connector/__init__.py", line 802, in __sync_file_from_ucs or (not old_dn and not self.sync_from_ucs(key, object, premapped_ucs_dn, old_dn, old, new))): File "/usr/lib/pymodules/python2.7/univention/s4connector/s4/__init__.py", line 2419, in sync_from_ucs self.lo_s4.lo.add_ext_s(compatible_modstring(object['dn']), compatible_addlist(addlist), serverctrls=ctrls) #FIXME encoding File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 187, in add_ext_s resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout) File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 476, in result3 resp_ctrl_classes=resp_ctrl_classes File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 483, in result4 ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop) File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 106, in _ldap_call result = func(*args,**kwargs) UNWILLING_TO_PERFORM: {'info': 'Failed to find primary group with RID 548!', 'desc': 'Server is unwilling to perform'}
Did it happened in a customer environment?
Builtin groups cannot be set as primary group for users in Samba/AD. I think umc should deny that.
My impression is, that Active Directory only allows a users primary group to be a domain group from the same domain as the user: ================================================================================ A user's primary group must be a group that exists in the user's primary domain. The SID for the primary group can be built by concatenating the domain RID with the primaryGroupID attribute of the user object. ================================================================================ source: https://support.microsoft.com/en-us/help/297951/how-to-use-the-primarygroupid-attribute-to-find-the-primary-group-for-a-user That's why I think it's a UDM/UMC issue, not an issue that the connector could fix.
This issue has been filled against UCS 4.1. The maintenance with bug and security fixes for UCS 4.1 has ended on 5st of April 2018. Customers still on UCS 4.1 are encouraged to update to UCS 4.3. Please contact your partner or Univention for any questions. If this issue still occurs in newer UCS versions, please use "Clone this bug" or simply reopen the issue. In this case please provide detailed information on how this issue is affecting you.