UCS 5.0-8 Changelog

Download PDF

Changelog for Univention Corporate Server (UCS) 5.0-8

Changelog for Univention Corporate Server (UCS) 5.0-8#

General#

  • UCS 5.0-8 includes the following updated packages from Debian 10.13:

    cacti, composer, distro-info-data, fossil, freeipa, frr, gross, gst-plugins-base1.0, gtkwave, jetty9, knot-resolver, less, libcaca, libdatetime-timezone-perl, libkf5ksieve, libpgjava, mediawiki, nodejs, node-xml2js, org-mode, putty, python-pymysql, qtbase-opensource-src, ruby-rack, shim-helpers-amd64-signed, trafficserver, tzdata, unadf, zfs-linux

  • UCS 5.0-8 includes the following packages in the maintained repository of UCS:

    crudeoauth

Domain services#

  • Fix dependency of server role packages to explicitly depend on a fixed version of Univention Configuration Registry. This fixes a regression caused by erratum 988 (Bug #57132).

LDAP Directory Manager#

  • Adjusted Univention Directory Manager to support declaring properties as lazy loading. If a property is lazy loading, UCS only fetches it, if explicitly requested. Added the flag --properties to Univention Directory Manager CLI to request specific properties (Bug #57110).

  • If the Univention Configuration Registry Variable directory/manager/mail-address/uniqueness has the value true, the uniqueness check for email addresses takes both user properties, mailPrimaryAddress and mailAlternativeAddress, into account. It’s now possible to swap the values for these properties with one change to the user object (Bug #57171).

  • Updated the Univention Directory Manager module settings/extended_attributes to include the property preventUmcDefaultPopup which UCS evaluates in the Univention Management Console. It inhibits UCS from warning the user that a modification sets the default value of a property (Bug #51187).

  • Addressed a regression impacting the modification of users/ldap objects within the Univention Management Console, stemming from erratum 1018 (Bug #57228).

  • Restored compatibility with Python 2.7, which erratum 991 has broken (Bug #57146).

  • Added ability to filter for various attributes using the Univention Directory Manager command line interface and in Univention Management Console. This includes sambaLogonHours and accountActivationDate for the users/user module, hwaddress for the dhcp/host module and ip for the dns/ptr_record module (Bug #54339, Bug #54339, Bug #53830, Bug #54339, Bug #53830, Bug #53807, Bug #54339, Bug #53830, Bug #53807, Bug #55604).

  • Added an asynchronous UDM HTTP REST API client (Bug #56735).

  • Administrators can specify a list of properties that UDM HTTP REST API should return. As a default behavior, UDM HTTP REST API returns all regular properties. UDM HTTP REST API only returns lazy loading properties, if explicitly requested (Bug #57110).

  • Enhanced the LDAP overlay slapd-sock by adding extendedresults as a possible value to the sockresps configuration option. With that configuration, the overlay outputs a changed LDIF in the RESULT phase, including LDAPControl data for PostReadControl and PreReadControl collected during CRUD operations. The output format is similar to the one used by the LDAP overlay auditlog with an additional control: field (Bug #57267).

  • Added the Univention Configuration Registry Variable directory/manager/feature/prepostread to configure univention.uldap to send LDAPControls PostReadControl and PreReadControl for the CRUD operations add, modify, modrdn, and delete. If UCS has this option activated, the LDAPControls instruct OpenLDAP to return all regular and operational attributes that are readable by the binddn before and after the change (Bug #57267).

  • UCS now allows configuring the LDAP overlay slapd-sock for sockresps extendedresults through the Univention Configuration Registry Variable ldap/overlay/sock. If activated, it outputs LDAP changes including LDIF for CRUD operations, not for search. Additionally, the Univention Configuration Registry Variable ldap/overlay/sock/sockops allows activating sockops add delete modify modrdn.

    Please note that activating that second Univention Configuration Registry Variable causes the slapd process to wait for confirmation for CRUD events, see man slapd-sock. So, you mustn’t activate it, unless there is a suitable process responding to the socket path /var/lib/univention-ldap/slapd-sock/sock. The purpose of these changes is to feed into the provisioning queue of Nubus (Bug #57267).

Univention Management Console#

Univention Management Console web interface#

  • When a user selects a different language inside the Univention Management Console, it didn’t use the language inside the modules. For example, the server provides German, but a user selects English as their preferred language, the modules were still in German. Fixed it and Univention Management Console uses the same language everywhere (Bug #57192).

Univention Portal#

  • In the past the user wasn’t able to unset their birthday inside the self service, because the input validation didn’t detect a valid date according to the ISO-8601 standard. Users can unset their birthday again (Bug #57023).

Univention Management Console server#

  • Univention Management Console now also logs the reason for a failed LDAP connection for module processes (Bug #57311).

  • The Univention Management Console SAML client is now updated in Keycloak on changes, for example when changing the Univention Configuration Registry Variable umc/saml/assertion-lifetime (Bug #57143).

  • Fixed a memory leak in the Univention Management Console server (Bug #57104).

  • Fixed a LDAP connection leak in the Univention Management Console server (Bug #57113).

  • The permission and ownership of the Univention Management Console log file is now only modified if it isn’t STDOUT or STDERR (Bug #57154).

  • If the UCS primary directory node is on UCS version 5.2-0 or higher, Univention Management Console no longer creates or configures a client for simpleSAMLphp (Bug #57163).

  • Added the option copytruncate to the logrotate configuration of Univention Management Console to not delete log files, but to truncate the original log file to zero size in place (Bug #56906).

  • Added a missing Univention Configuration Registry Variable to the trigger the apache2 univention.conf (Bug #57229).

Modules for system settings / setup wizard#

  • Adapted the Univention Management Console IP change module to check the zone of the single sign-n domain name case insensitively (Bug #57290).

System diagnostic module#

  • Added a diagnostic module to monitor the state of app queues (Bug #57217).

Policies#

  • univention-policy uses the StartTLS operation mode configured through the Univention Configuration Registry Variable directory/manager/starttls (Bug #57158, Bug #57173).

  • univention-policy uses the LDAP port configured through the Univention Configuration Registry Variable ldap/server/port (Bug #57159, Bug #57173).

  • Added a compiler flag to the building process to detect certain memory errors during the execution of univention_policy_result (Bug #57257).

LDAP directory browser#

  • The Univention Management Console Univention Directory Manager module fetches all lazy loading properties (Bug #57110).

Univention base libraries#

  • Added the LDAP schema attributes for the UCS authorization engine Guardian roles (Bug #57110).

  • Even though all OCs inherit from top and ldapsearch actually finds them when searching for (objectClass=top), the (inherited) objectClass: top doesn’t show up as an attribute in the output of ldapsearch (Bug #50268).

  • Updated the Univention Directory Manager module settings/extended_attributes to include the property preventUmcDefaultPopup which UCS evaluates in the Univention Management Console. It inhibits UCS from warning the user that a modification sets the default value of a property (Bug #51187).

  • Erratum 991 improved the LDAP filters for DNS objects in Univention Directory Manager, but forgot to add an LDAP index for the sOARecord attribute there. This update fixes that and improves the performance of the Univention Management Console modules computers and school computers, especially for teachers in UCS@school environments, which are subject to a larger number of LDAP ACLs (Bug #57193).

  • Added the helper functions ucs_needsKeycloakSetup, ucs_needsSimplesamlphpSetup, and ucs_primaryVersionGreaterEqual to easier evaluate what kind of SAML setup the domain needs (Bug #57163).

System services#

SAML#

  • Changed the LDAP filter for user objects in the LDAP federation configuration to require the attribute uid (Bug #57205).

RADIUS#

  • The RADIUS server now supports different MAC address formats for the MAB (MAC Authentication Bypass) feature (Bug #57069).

  • The default enabled configuration under /etc/freeradius/3.0/sites-enabled/ was reset to the default one during installation. This breaks setups with custom configurations (Bug #55007).

Other changes#

  • Newer version of package is required as build time dependency for runc, containerd and docker.io (Bug #56457).

  • Fix Debian Bug #960887: Use of uninitialized value $caller (Bug #56457).

  • Updated the following product logos: login page icon, favicon, portal icon, and Univention Management Console portal entry icon (Bug #57378).

  • Added the GPG/PGP public key univention-archive-key-ucs-52x.gpg for UCS version 5.2. This key signs the UCS version 5.2 repository (Bug #57312).

On this page