Bug 56662 - Require memberOf overlay module
Summary: Require memberOf overlay module
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: LDAP
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.1
Assignee: Florian Best
QA Contact: Juan Carlos
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-26 11:53 CEST by Florian Best
Modified: 2025-02-05 15:08 CET (History)
4 users (show)

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number: 2023082221000326
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2023-09-26 11:53:21 CEST
Since Bug #46066 UCS 4.3 the memberOf overlay module is enabled for new installations but not for upgraded systems.

The release notes don't say that memberOf overlay is required:
https://docs.software-univention.de/release-notes-4.3-0-en.html#changelog:domain:openldap
> Starting with UCS 4.3 the openldap overlay module for reverse group membership maintenance (memberOf) is activated by default for new installations, see the openldap documentation https://www.openldap.org/doc/admin24/overlays.html#Reverse Group Membership Maintenance for more information. This applies for new installations only, during the update to 4.3 the memberOf overlay module is installed but deactivated (if not already activated). Information on how to activate the memberOf overlay module can be found in https://help.univention.com/t/6439 (Bug 46066).

No further release (release note or preup.sh check) made a requirement to enforce the enabling of memberOf overlay.

The current docs also mention that one can configure the used "memberOf" attribute:
https://docs.software-univention.de/manual/5.0/en/groups.html#overlay-module-for-displaying-the-group-information-on-user-objects

Without the memberOf overlay module enabled UDM group memberships, UDM REST API access and some SAML features don't work.

We should:
* drop the configurability of the memberOf overlay module: hardcode that it is enabled and the attribute is named "memberOf"
* add to the release notes that it is required
* remove configurability from the manual
* add a preup.sh check, which checks if it is enabled.
Comment 2 Erik Damrose univentionstaff 2023-09-26 13:05:00 CEST
management/univention-management-console-module-diagnostic/umc/python/diagnostic/plugins/58_check_memberOf.py should be checked and maybe removed if memberof is mandatory and cannot be disabled
Comment 3 Juan Carlos univentionstaff 2023-11-16 10:20:23 CET
QA:

* drop the configurability of the memberOf overlay module: hardcode that it is enabled and the attribute is named "memberOf" - OK
* add to the release notes that it is required - OK
* remove configurability from the manual - OK
Comment 4 Florian Best univentionstaff 2024-03-08 10:49:35 CET
univention-system-setup (14.0.5)
aceec5f12812 | refactor(memberof): require memberof to be enabled

univention-management-console-module-diagnostic (7.0.6)
aceec5f12812 | refactor(memberof): require memberof to be enabled

univention-ldap-overlay-memberof (13.0.3)
aceec5f12812 | refactor(memberof): require memberof to be enabled

univention-join (13.0.6)
aceec5f12812 | refactor(memberof): require memberof to be enabled

univention-directory-replication (14.0.3)
aceec5f12812 | refactor(memberof): require memberof to be enabled

ucs-test (11.0.9)
aceec5f12812 | refactor(memberof): require memberof to be enabled