Description Dirk Wiesenthal 2024-05-22 19:53:28 CEST

The update check in the preup.sh to 5.1/5.2 "update_check_user_country_mapping" is very strict and very simple. It just checks the UCR variable directory/manager/web/modules/users/user/map-country-to-st.

This variable is set to the "correct" value via the script /usr/share/univention-directory-manager-tools/udm-remap-country-from-st-to-c that admins have to execute before the update. So far, so good.

But: This script creates a UCR policy with the respective UCR variable. Now, theoretically, you could have a, say, replica, that wants to update to 5.2 but is not allowed because the UCR policy did not apply for some reason.

But if the replica wants to update, the primary MUST be at least at 5.2 already. So the primary MUST have run the script before. Checking the UCR variable _again_ on the replica is just too strict.

Although you expect the variable to be set via the policy, we really don't need to be that strict. Especially because the error message says:

[...]
The migration can be performed using the command ...
[...]

But this command may only be run on the primary. So the admin is stuck until they figure out that they need to get that UCR variable via the policy.

Happened in our jenkins jobs. Real life problems seem improbable. Still, it would be far better to only run the test update_check_user_country_mapping on the primary.