Bug 50896 - Join Ubuntu clients in UCS@school environments
Summary: Join Ubuntu clients in UCS@school environments
Status: RESOLVED DUPLICATE of bug 49847
Alias: None
Product: UCS
Classification: Unclassified
Component: Univention Domain Join (Ubuntu)
Version: UCS 4.4
Hardware: Other Linux
: P5 normal
Target Milestone: ---
Assignee: UCS maintainers
QA Contact: UCS maintainers
URL:
Keywords:
: 50879 (view as bug list)
Depends on: 50879
Blocks:
  Show dependency treegraph
 
Reported: 2020-03-04 16:29 CET by Christina Scheinig
Modified: 2020-03-06 15:59 CET (History)
4 users (show)

See Also:
What kind of report is it?: Feature Request
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?: Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number: 2020021421000241, 2019112521000779
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christina Scheinig univentionstaff 2020-03-04 16:29:26 CET
+++ This bug was initially created as a clone of Bug #50879 +++

Since UCC is not being developed further, there is currently no possibility to use Linux @school.

It would be desirable to have at least a tool- or script-supported support for joining the clients to the school slave.

Despite restrictions in share access and class work mode, there are different possibilities of use at schools; e.g. internet terminal, computer lessons on different OS, programming under Linux. The usage of Linux should 'be open'

Existing restrictions should be pointed out explicitly.
Comment 1 Christina Scheinig univentionstaff 2020-03-04 16:31:06 CET
The customer wants to join his Ubuntu client in a @school environment with the Domain Join Client.
If this feature request is not correct in this category, we can change the category. 

The request does not contain any functionality from @school but only the join against the school slave.
Comment 2 Ingo Steuwer univentionstaff 2020-03-04 17:19:18 CET
*** Bug 50879 has been marked as a duplicate of this bug. ***
Comment 3 Ingo Steuwer univentionstaff 2020-03-04 17:21:43 CET
I modified the subject as my current understanding is that no full support by UCS@school is requested, but a working domain join.

Can you describe what problems you have while using the Ubuntu Domain Join in UCS@school environments?

What do you expect which is not working as of today?
Comment 4 Dirk Schnick univentionstaff 2020-03-06 12:27:15 CET
You can not easily join a linux PC on a school slave, because slaves are missing the certificates.
There is a need of several manual changes to do, to join a linux server on a school slave (see Ticket 2019112521000779 Entry 15 for details)
Comment 5 Ingo Steuwer univentionstaff 2020-03-06 13:02:06 CET
Im I right that the main issue here is not to join the client (which definitely needs some access to the Master to define a host password), but to use it later on without access to the DC Master?

If yes this is a duplicate of #49847 - or do I miss something?
Comment 6 Christina Scheinig univentionstaff 2020-03-06 15:37:30 CET
(In reply to Ingo Steuwer from comment #5)
> Im I right that the main issue here is not to join the client (which
> definitely needs some access to the Master to define a host password), but
> to use it later on without access to the DC Master?
> 
> If yes this is a duplicate of #49847 - or do I miss something?

As I recall this was the desire of the customer.

But I am not sure, why we can not use the same mechanism to join a ubuntu on a school site as we do with a windows client. Maybe I am missing something.
-----------------------
In my earlier tests I could not join against the master, but adjusting the following config files made it possible to login against the school slave.

In the configuration files the settings must be changed from Master to School Slave. 

/etc/auth-client-config/profile.d/sss
/etc/sssd/sssd.conf
/etc/machine.secret
/etc/ldap/ldap.conf
/usr/share/pam-configs/ucs_mkhomedir
/etc/krb5.conf

The DNS can be changed with this command:

nmcli con mod 'Kabelgebunden Verbindung1' ipv4.dns "10.200.43.33"

'nmcli connection show' shows the name of the connection → for me 'Kabelgebunden Verbindung1' The IP is the one of my school slave.
Comment 7 Ingo Steuwer univentionstaff 2020-03-06 15:59:17 CET
(In reply to Christina Scheinig from comment #6)
> (In reply to Ingo Steuwer from comment #5)
> > Im I right that the main issue here is not to join the client (which
> > definitely needs some access to the Master to define a host password), but
> > to use it later on without access to the DC Master?
> > 
> > If yes this is a duplicate of #49847 - or do I miss something?
> 
> As I recall this was the desire of the customer.

I close this as duplicate and add your comment to the other one.

*** This bug has been marked as a duplicate of bug 49847 ***