Bug 54038 - Fix Joinscript idempotence: Kerberos-based SAML-SSO is not working for Windows clients joined to a UCS@school schoolserver
Summary: Fix Joinscript idempotence: Kerberos-based SAML-SSO is not working for Window...
Status: NEW
Alias: None
Product: UCS@school
Classification: Unclassified
Component: General
Version: UCS@school 5.0
Hardware: Other All
: P5 normal
Target Milestone: ---
Assignee: UCS@school maintainers
QA Contact:
URL:
Keywords:
Depends on: 51078
Blocks:
  Show dependency tree / graph
 
Reported: 2021-11-09 09:51 CET by Erik Damrose
Modified: 2022-11-09 11:31 CET (History)
7 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 2: A Pain – users won’t like this once they notice it
User Pain: 0.057
Enterprise Customer affected?:
School Customer affected?: Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID: 05017, 09739
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Erik Damrose univentionstaff 2021-11-09 09:51:54 CET 
At the original bug a fix was implemented to add a servicePrincipalName to the ucs-sso user on school replica servers. However, there is a check around that functionality:
if [ $JS_LAST_EXECUTED_VERSION -lt 5 ]; then ...

Simply re-executing the joinscript will not fix the missing SPN issue if present. The check should be removed.

62ucs-school-nonedu-slave.inst
62ucs-school-slave.inst

+++ This bug was initially created as a clone of Bug #51078 +++