Bug 55574 – clean install of a test AD throws an error in the s4 connector

Bug 55574 - clean install of a test AD throws an error in the s4 connector


Summary:	clean install of a test AD throws an error in the s4 connector

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	AD Connector
Version:	UCS 5.0
Hardware:	Other All

Importance:	P5 major (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2023-01-17 04:25 CET by Telirand
Modified:	2023-01-17 04:25 CET (History)
CC List:	0 users

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Telirand 2023-01-17 04:25:09 CET

This was a clean VM.
start with the univention install of 5.x & upgrade during install.

no errors.

added the AD connector to add a samba DS.


checked the  s4 connection log

saw the following:

17.01.2023 11:03:26.362 LDAP        (PROCESS): sync UCS > AD: [         group] [       add] 'cn=Computers,cn=groups,DC=org,DC=blown-up,DC=com'
17.01.2023 11:03:26.398 LDAP        (PROCESS): sync UCS > AD: [          user] [       add] 'cn=join-slave,cn=users,DC=org,DC=blown-up,DC=com'
17.01.2023 11:03:26.405 LDAP        (WARNING): sync failed, saved as rejected
	/var/lib/univention-connector/s4/1673924273.277086
17.01.2023 11:03:26.409 LDAP        (WARNING): Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/univention/s4connector/__init__.py", line 827, in __sync_file_from_ucs
    if not self.sync_from_ucs(key, mapped_object, pre_mapped_ucs_dn, old_dn, old, new):
  File "/usr/lib/python3/dist-packages/univention/s4connector/s4/__init__.py", line 2111, in sync_from_ucs
    con_create_extension(self, property_type, object, addlist, ctrls)
  File "/usr/lib/python3/dist-packages/univention/s4connector/s4/__init__.py", line 124, in add_primary_group_to_addlist
    primary_group_sid = decode_sid(ldap_object_ad_group['objectSid'][0])
TypeError: 'NoneType' object is not subscriptable

17.01.2023 11:03:26.415 LDAP        (PROCESS): sync UCS > AD: [         group] [       add] 'cn=Slave Join,cn=groups,DC=org,DC=blown-up,DC=com'
17.01.2023 11:03:26.496 LDAP        (PROCESS): sync UCS > AD: [          user] [       add] 'cn=join-backup,cn=users,DC=org,DC=blown-up,DC=com'
17.01.2023 11:03:26.530 LDAP        (WARNING): sync failed, saved as rejected
	/var/lib/univention-connector/s4/1673924273.282058
17.01.2023 11:03:26.531 LDAP        (WARNING): Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/univention/s4connector/__init__.py", line 827, in __sync_file_from_ucs
    if not self.sync_from_ucs(key, mapped_object, pre_mapped_ucs_dn, old_dn, old, new):
  File "/usr/lib/python3/dist-packages/univention/s4connector/s4/__init__.py", line 2111, in sync_from_ucs
    con_create_extension(self, property_type, object, addlist, ctrls)
  File "/usr/lib/python3/dist-packages/univention/s4connector/s4/__init__.py", line 124, in add_primary_group_to_addlist
    primary_group_sid = decode_sid(ldap_object_ad_group['objectSid'][0])
TypeError: 'NoneType' object is not subscriptable

17.01.2023 11:03:26.534 LDAP        (PROCESS): sync UCS > AD: [         group] [       add] 'cn=Backup Join,cn=groups,DC=org,DC=blown-up,DC=com'




There is no file 
/var/lib/univention-connector/s4/1673924273.277086

so it looks like an "out of order" sync, since:

nivention-s4connector-list-rejected

UCS rejected


S4 rejected


There may be no rejected DNs if the connector is in progress, to be
sure stop the connector before running this script.


	last synced USN: 4164



At the very least the error should be better trapped..