Bug 58738 - sync_to_ucs: Changing sAMAccountName and then CN leads to reject [5.2]
Summary: sync_to_ucs: Changing sAMAccountName and then CN leads to reject [5.2]
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: AD Connector
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.2-3-errata
Assignee: Arvid Requate
QA Contact: Jürn Brodersen
URL: https://git.knut.univention.de/univen...
Keywords:
Depends on:
Blocks: 58737
  Show dependency tree / graph
 
Reported: 2025-10-24 13:43 CEST by Arvid Requate
Modified: 2025-11-05 14:26 CET (History)
1 user (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 5: Blocking further progress on the daily work
User Pain: 0.143
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number: 2025100221000098
Bug group (optional):
Customer ID:
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2025-10-24 13:43:20 CEST 
We should first fix this in 5.2-3 and then backport to 5.0-10 via Bug #58737.

+++ This bug was initially created as a clone of Bug #58737 +++

A sAMAccountName change doesn't update `DN Mapped CON` cache and then a subsequent change of CN (leading to a modrdn DN change in AD) causes a traceback in the connector-ad.log, because the connector doesn't find the cached `olddn` (AD-DN mapped to UCS-DN) because it doesn't match reality any more. But even during the first step there's already a traceback, because the `post_ucs_modify_functions` can't find the object any longer using `ucs_object['dn']`:

[...]
Comment 1 Arvid Requate univentionstaff 2025-10-25 18:41:39 CEST 
f6364263fb4 | feat(ad-connector): update object['dn'] in modify_in_ucs
a23812a0cf7 | test(adconnector): AD-Connector cache 'DN Mapping CON' update on uid change

Package: univention-ad-connector
Version: 16.4.4
Release: 5.2-0
Scope: errata5.2-3

Package: ucs-test
Version: 12.3.24
Release: 5.2-0
Scope: errata5.2-3
Comment 2 Jürn Brodersen univentionstaff 2025-11-04 16:40:06 CET 
Looks good to me

Jenkins: OK
Manual test: OK
yaml: OK
Comment 3 Dirk Wiesenthal univentionstaff 2025-11-05 14:26:14 CET 
<https://errata.software-univention.de/#/?erratum=5.2x276>