Bug 55756 – AD-Connector TLS with sub-CA-Cert stopped working after update from 4.4-9 to 5.0-3

Bug 55756 - AD-Connector TLS with sub-CA-Cert stopped working after update from 4.4-9 to 5.0-3


Summary:	AD-Connector TLS with sub-CA-Cert stopped working after update from 4.4-9 to ...

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	AD Connector
Version:	UCS 5.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:	49348
Blocks:
	Show dependency tree / graph

Reported:	2023-02-24 13:35 CET by Arvid Requate
Modified:	2023-03-16 17:35 CET (History)
CC List:	3 users (show)

See Also:
What kind of report is it?:	Bug Report
What type of bug is this?:	4: Minor Usability: Impairs usability in secondary scenarios
Who will be affected by this bug?:	1: Will affect a very few installed domains
How will those affected feel about the bug?:	3: A User would likely not purchase the product
User Pain:	0.069
Enterprise Customer affected?:	Yes
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:	2023022121000482
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2023-02-24 13:35:04 CET

After updating from 4.4-9 to 5.0-3 a customer reported that the AD-Connector now fails establishing the LDAP TLS connection to the AD. The special thing is, that the customer uses a sub-CA certificate for his AD-domain, which is signed by the UCS root CA.

In UCS 4.4-9 it was enough to have the sub-CA cert in

 /etc/univention/connector/ad/customer_ad_cert.pem

And the UCS-root-CA cert in /etc/ssl/certs.

Now, with 5.0-x the LDAP libs seem to ignore the system CA certs if you specify a file with lo.set_option(ldap.OPT_X_TLS_CACERTFILE, ca_certfile), as we do in the uldap module code that is used by the AD-Connector.

After appending also the UCS-root-CA cert to the ca_certfile the AD-Connector works again. Don't know if we can improve user experience here on code level or only on documentation level. I think the latter is required anyway as, on the topic of sub-CAs and CA certificate chains I did not quickly find anything specific for AD-Connector setups.

Comment 1 Felix Botner

2023-02-24 13:58:20 CET

What about https://forge.univention.org/bugzilla/show_bug.cgi?id=49348 - just using the global store /etc/ssl.