Bug 52131 – joinscript api should supply binddn and bindpwdfile on primary and backup nodes

Bug 52131 - joinscript api should supply binddn and bindpwdfile on primary and backup nodes


Summary:	joinscript api should supply binddn and bindpwdfile on primary and backup nodes

Status:	RESOLVED DUPLICATE of bug 47494

Product:	UCS
Classification:	Unclassified
Component:	Join (univention-join)
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2020-09-24 09:49 CEST by Daniel Tröder
Modified:	2020-10-08 19:03 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Feature Request
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	API change
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Daniel Tröder

2020-09-24 09:49:54 CEST

The join script API is inconsistent in that way:
* On replication and managed nodes the univention-run-join-scripts adds "--binddn BINDDN --bindpwdfile BINDPWDFILE" to the arguments in "$@" which are forwarded to all software using the LDAP when called in join scripts.
* On primary and backup nodes the user can retrieve the credentials herself, so univention-run-join-scripts does _not_ add those to the join scripts args. All software called with "$@" has to be aware of that.

This has led to a lot of lost development hours by (also experienced) Univention developers getting surprised by this unexpected API behavior. It has furthermore lead to hundreds of Python and shell scripts implementing all the same forumla: "if role in (master, backup) read secret-file, else use arguments passed".

The joinscript api should be consistent: it should supply binddn and bindpwdfile on all nodes.

Comment 1 Daniel Tröder

2020-09-24 09:50:54 CEST

Latest occurrence: Bug 51519#c5.

Comment 2 Philipp Hahn

2020-10-08 19:03:10 CEST


*** This bug has been marked as a duplicate of bug 47494 ***