Bug 49228

Summary: resync-objects.py script has hard coded 389 ldap port
Product: UCS Reporter: Jürn Brodersen <brodersen>
Component: Listener (univention-directory-listener)Assignee: Jürn Brodersen <brodersen>
Status: CLOSED FIXED QA Contact: Felix Botner <botner>
Severity: normal    
Priority: P5 CC: schwardt
Version: UCS 4.4   
Target Milestone: UCS 4.4-0-errata   
Hardware: Other   
OS: Linux   
What kind of report is it?: Bug Report What type of bug is this?: 6: Setup Problem: Issue for the setup process
Who will be affected by this bug?: 2: Will only affect a few installed domains How will those affected feel about the bug?: 2: A Pain – users won’t like this once they notice it
User Pain: 0.137 Enterprise Customer affected?:
School Customer affected?: ISV affected?:
Waiting Support: Yes Flags outvoted (downgraded) after PO Review:
Ticket number: 2019032921000269 Bug group (optional):
Max CVSS v3 score:

Description Jürn Brodersen univentionstaff 2019-04-04 10:27:02 CEST
resync-objects.py script has hard coded 389 ldap port

The 4.4 radius implementation uses this script to resync the shared secret of existing authenticators to slaves. In case samba4 is installed on the slave the script fails.

Use uldap.getRootDnConnection instead.
Comment 1 Jürn Brodersen univentionstaff 2019-04-04 10:29:36 CEST
Traceback (most recent call last):
File "/usr/share/univention-directory-listener/resync-objects.py", line 108, in <module>
main()
File "/usr/share/univention-directory-listener/resync-objects.py", line 69, in main
local = uldap.access(binddn=binddn, bindpw=bindpw, start_tls=0, host="localhost", port=389)
File "/usr/lib/pymodules/python2.7/univention/uldap.py", line 244, in _init_
self.__open(ca_certfile)
File "/usr/lib/pymodules/python2.7/univention/uldap.py", line 310, in __open
self.lo.simple_bind_s(self.binddn, self.__encode_pwd(self.bindpw))
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 949, in simple_bind_s
res = self._apply_method_s(SimpleLDAPObject.simple_bind_s,*args,**kwargs)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 931, in _apply_method_s
return func(self,*args,**kwargs)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 223, in simple_bind_s
resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 514, in result3
resp_ctrl_classes=resp_ctrl_classes
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 521, in result4
ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 106, in _ldap_call
result = func(*args,**kwargs)
ldap.STRONG_AUTH_REQUIRED: {'info': 'BindSimple: Transport encryption required.', 'desc': 'Strong(er) authentication required'}
Comment 2 Jürn Brodersen univentionstaff 2019-04-25 17:08:05 CEST
Resync of objects that did not already exist locally was also broken and should now be fixed.

[4.4-0 0f6e8816ca] Bug #49228: Fix resync-objects script
[4.4-0 de9b5359dc] Bug #49228: yaml

Package: univention-directory-listener
Version: 13.0.2-3A~4.4.0.201904251701
Branch: ucs_4.4-0
Scope: errata4.4-0
Comment 3 Jürn Brodersen univentionstaff 2019-04-26 14:55:18 CEST
The script now stops if server/role is not set to domaincontroller_backup or domaincontroller_slave.

[4.4-0 4390e78584] Bug #49228: exit resync-objects.py early on master servers
[4.4-0 de983c3cc4] Bug #49228: yaml

Package: univention-directory-listener
Version: 13.0.2-4A~4.4.0.201904261449
Branch: ucs_4.4-0
Scope: errata4.4-0
Comment 4 Jürn Brodersen univentionstaff 2019-04-29 10:34:34 CEST
[4.4-0 b0aebe4de9] Bug #49228: only update object if attributes differ
[4.4-0 25ec96f783] Bug #49228: yaml

Package: univention-directory-listener
Version: 13.0.2-5A~4.4.0.201904282204
Branch: ucs_4.4-0
Scope: errata4.4-0
Comment 5 Felix Botner univentionstaff 2019-04-29 11:12:00 CEST
OK - univention-directory-listener
OK - univention-directory-listener.yaml
Comment 6 Arvid Requate univentionstaff 2019-05-02 13:22:19 CEST
<http://errata.software-univention.de/ucs/4.4/69.html>