Bug 33319

Summary:	missing member in Domain Admins after univention-ad-takeover
Product:	UCS	Reporter:	Felix Botner <botner>
Component:	Samba4	Assignee:	Stefan Gohmann <gohmann>
Status:	CLOSED FIXED	QA Contact:	Felix Botner <botner>
Severity:	normal
Priority:	P5	CC:	gohmann, requate, walkenhorst
Version:	UNSTABLE
Target Milestone:	UCS 3.2-3-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	---	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:
Attachments:	ad-takeover.log connector-s4.log.gz user.vbs

Description Felix Botner

2013-11-12 13:53:46 CET

* w2k8 R2 AD
* added 1500 users and 40 groups
* added "testuser1500" to "Domänen-Admins"

* installed UCS 3.2 with samba4
* started univention-ad-takeover
* all users and groups were migrated to UCS, but the membership of 
  "testuser1500" in "Domain Admins" is missing

Comment 1 Felix Botner

2013-11-12 13:54:42 CET

Created attachment 5610 [details]
ad-takeover.log

Comment 2 Felix Botner

2013-11-12 13:55:14 CET

Created attachment 5611 [details]
connector-s4.log.gz

Comment 3 Felix Botner

2014-04-22 09:25:56 CEST

Created attachment 5880 [details]
user.vbs

Comment 4 Stefan Gohmann

2014-09-04 07:20:56 CEST

The problem is that the group exists on both sides. I've extended the test case 101sync_initial_membership_ad_to_ucs to match this issue: 
UCS 3.2-3: r53332
UCS 4.0-0: r53333

I've added a special handling for this situation. The group members are no longer removed if the group exists on both sides and the members are different.

UCS 3.2-3: r53334
UCS 4.0-0: r53335
YAML: r53336

Comment 5 Felix Botner

2014-09-05 13:05:29 CEST

OK - sync 
OK - tests
OK - UCS 4.0
OK - YAML

Comment 6 Janek Walkenhorst

2014-09-10 17:41:22 CEST

http://errata.univention.de/ucs/3.2/199.html