Bug 56021 – Situation unclear: Can GPOs for wireless devices (IEEE80211) be managed from School-replica servers?

Bug 56021 - Situation unclear: Can GPOs for wireless devices (IEEE80211) be managed from School-replica servers?


Summary:	Situation unclear: Can GPOs for wireless devices (IEEE80211) be managed from ...

Status:	NEW

Product:	UCS@school
Classification:	Unclassified
Component:	Samba 4 - Slave PDC
Version:	UCS@school 5.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:

URL:
Keywords:

Depends on:	50626
Blocks:
	Show dependency tree / graph

Reported:	2023-04-27 16:41 CEST by Arvid Requate
Modified:	2023-06-08 14:06 CEST (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	Bug Report
What type of bug is this?:	5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?:	1: Will affect a very few installed domains
How will those affected feel about the bug?:	3: A User would likely not purchase the product
User Pain:	0.086
Enterprise Customer affected?:
School Customer affected?:	Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:	2023042621000488
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2023-04-27 16:41:27 CEST

For customers and support the situation is unclear regarding the question if GPOs, in particular for wireless devices (IEEE80211) can be managed (add/modify/delete) from School-replica servers. For Bug 50626 we enabled the replication from UCS@school primary to the replicas. It's unclear if the reverse is supported.


In a support case we saw an S4-Connector reject for this operation in the logs of a School replica server:
====================================================
26.04.2023 16:49:15.820 LDAP        (PROCESS): sync AD > UCS: [ms/gpwl-wireless] [       add] 'CN=Foo,CN=IEEE80211,CN=Windows,CN=Microsoft,CN=Machine,CN={D8F4385A-EC6D-43FE-A292-F147DEB146E2},CN=Policies,CN=System,dc=customer,dc=domain'
[...]
ldap.INSUFFICIENT_ACCESS: {'desc': 'Insufficient access', 'info': 'no write access to entry'}
====================================================

Apart from the question of LDAP-ACLs, supporting management of GPOs on/from School replica servers would require "upstream" replication of sysvol data from the School replica to the UCS@school primary. I'm unsure if this is still enabled by default or what general recommendations are with respect to that topic.

So it's unclear, what needs to be adjusted here:

a) expectations -> documentation
b) concept -> documentation & code
c) just a bug -> code