Bug 50607 - Fetchmail: Backup2master problem with package that deploy LDAP Schema locally
Fetchmail: Backup2master problem with package that deploy LDAP Schema locally
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: App Center
UCS 4.2
Other Linux
: P5 normal (vote)
: UCS 4.4-3-errata
Assigned To: Dirk Wiesenthal
Jannik Ahlers
https://help.univention.com/t/problem...
:
Depends on:
Blocks: 49463
  Show dependency treegraph
 
Reported: 2019-12-06 14:35 CET by Dirk Wiesenthal
Modified: 2019-12-16 13:03 CET (History)
10 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 7: Crash: Bug causes crash or data loss
Who will be affected by this bug?: 2: Will only affect a few installed domains
How will those affected feel about the bug?: 5: Blocking further progress on the daily work
User Pain: 0.400
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dirk Wiesenthal univentionstaff 2019-12-06 14:35:54 CET
+++ This bug was initially created as a clone of Bug #49463 +++

Steps to reproduce:

Installing an app which provides a schema extension.
Editing some LDAP objects to use this app which will add attributes to the LDAP object.
De-installation of app as no longer needed.

LDAP Schema extension is still available in LDAP by purpose (otherwise the object attributes would be invalid).

Setting up a backup server, installing same packages and same versions of current installed master. This backup will replicate the schema extensions but will not have the local schema files installed (as the app is not installed any longer).

Now doing backup2master and you will get couple of rejects or similar failures due to unknown attributes on the objects.

Trying to filter them out through https://help.univention.com/t/problem-after-a-ldap-schema-was-removed-there-are-still-some-references-in-your-ldap/11810 will frequently bring other issues...

We should make sure a backup2master will have the same LDAP schemas on the new master.
Comment 1 Dirk Wiesenthal univentionstaff 2019-12-06 22:15:57 CET
Fixed in
  univention-fetchmail 12.0.4-3A~4.4.0.201912061515

univention-fetchmail now uses ucs_registerLDAPExtension in its joinscript instead of ucs_registerLDAPSchema in its postinst.

It also registers the ACL file 58univention-fetchmail_acl-settings. But it was renamed to 58univention-fetchmail-schema.acl.

/etc/ldap/slapd.conf looks the same before and after the update. (disregarding the UCR template name)

For updates,
/etc/univention/templates/info/univention-fetchmail-schema.info
/etc/univention/templates/files/etc/ldap/slapd.conf.d/58univention-fetchmail_acl-settings
are removed.

That is the reason for the rename: If the ACL file was registered by UDM *before* the package was updated on DC Master, the update would remove the ACL file.

Now, the ACL file may be registered twice in this case. But this is fine, in this case, the rules are just doubled. It does no harm.
Comment 2 Jannik Ahlers univentionstaff 2019-12-11 09:14:34 CET
I fixed a small typo in the yaml.

(In reply to Dirk Wiesenthal from comment #1)
> Fixed in
>   univention-fetchmail 12.0.4-3A~4.4.0.201912061515

actually univention-fetchmail 12.0.4-7A~4.4.0.201912061609

> univention-fetchmail now uses ucs_registerLDAPExtension in its joinscript
> instead of ucs_registerLDAPSchema in its postinst.
> 
> It also registers the ACL file 58univention-fetchmail_acl-settings. But it
> was renamed to 58univention-fetchmail-schema.acl.
> 
> /etc/ldap/slapd.conf looks the same before and after the update.
> (disregarding the UCR template name)

Diff looks good

> For updates,
> /etc/univention/templates/info/univention-fetchmail-schema.info
> /etc/univention/templates/files/etc/ldap/slapd.conf.d/58univention-
> fetchmail_acl-settings
> are removed.

OK

> That is the reason for the rename: If the ACL file was registered by UDM
> *before* the package was updated on DC Master, the update would remove the
> ACL file.
> 
> Now, the ACL file may be registered twice in this case. But this is fine, in
> this case, the rules are just doubled. It does no harm.

Looks good.
-> Verified
Comment 3 Erik Damrose univentionstaff 2019-12-11 16:49:44 CET
<http://errata.software-univention.de/ucs/4.4/394.html>