General

General#

  • Univention Corporate Server 5.2-5 includes the following updated packages from Debian 12.13:

    base-files bash btrfs-progs busybox distro-info-data intel-microcode libcap2 python-urllib3 shadow sudo allow-html-temp angular.js c-icap-modules calibre cdebootstrap chkrootkit chromium composer cyrus-imapd dar debian-installer debian-installer-netboot-images debian-security-support docker.io dpdk e2guardian emacs-libvterm freerdp2 gegl ghdl gimp golang-github-containerd-stargz-snapshotter golang-github-containers-buildah golang-github-openshift-imagebuilder lemonldap-ng libclamunrar libcommons-lang-java libcommons-lang3-java libhtp libnginx-mod-http-lua libphp-adodb libpod libreoffice libyaml-syck-perl log4cxx luksmeta lxd mediawiki modsecurity-apache modsecurity-crs mongo-c-driver munge mydumper nginx nova nvidia-open-gpu-kernel-modules onetbb open-vm-tools openrefine openvpn pg-snakeoil pgbouncer python-django python-django-storages qpwgraph r-cran-gh rails rear rlottie roundcube ruby-sinatra rust-cbindgen-web sash shaarli skeema snapd sogo supermin symfony syslog-ng thunderbird tomcat10 tripwire u-boot ublock-origin usbmuxd user-mode-linux vlc vtk9 webkit2gtk wordpress xrdp zsh

Domain services#

LDAP Directory Manager#

  • The Recycle Bin listener module is now deactivated by default and can be activated through setting the Univention Configuration Registry Variable listener/module/recyclebin/deactivate to false. Recycle Bin policies can now deactivate the creation of Recycle Bin objects for a whole subtree. All occurrences of Recyclebin in user-facing places have been renamed to Recycle Bin (Bug #58887).

  • Allow dash in uid and gid syntaxes also as last character (Bug #58898).

  • The performance of group membership updates for user and computer objects has been improved (Bug #58899).

  • The DN of objects in the Recycle Bin has been shortened to just OriginalUniventionObjectIdentifier=$ID,cn=recyclebin,cn=internal (Bug #58931).

  • Fix UnboundLocalError in logging in syntax.py (Bug #58982).

  • Fixed: Errata 282 introduced a change to univention-directory-manager-modules requiring a restart of dependent services. A UCS@school service was missing from the restart list (Bug #58992).

  • UDM now shows a default for univentionObjectIdentifier if not set in OpenLDAP (Bug #58987).

  • When deleting a container, the group membership of the objects within that container is now correctly removed (Bug #56986).

  • All occurrences of Recyclebin in user-facing places have been renamed to Recycle Bin (Bug #58887).

  • A new endpoint /udm/-/reload has been added to reload UDM extensions, automatically called whenever such an extension is registered (Bug #50253).

  • Improved error handling in listener handler for reloading UDM REST service (Bug #58970).

  • Load extended UDM attributes in unmap-ldap-attributes endpoint (Bug #58970).

  • Allow configuration of the root_path to reduce the complexity on the reverse proxy (Bug #59032).

Univention Management Console#

Univention Management Console server#

  • Allow configuration of the root_path to reduce the complexity on the reverse proxy (Bug #59033).

System diagnostic module#

  • Improved error message in univentionObjectIdentifier test (Bug #58987).

  • Improve the handling of SSL certificate checks when external certificates are configured. The diagnostic tool now provides actionable guidance when detecting hostname mismatches instead of failing with a traceback (Bug #55576).

LDAP directory browser#

  • All occurrences of Recyclebin in user-facing places have been renamed to Recycle Bin (Bug #58887).

  • A new endpoint /udm/-/reload has been added to reload UDM extensions, automatically called whenever such an extension is registered (Bug #50253).

Univention base libraries#

  • All occurrences of Recyclebin in user-facing places have been renamed to Recycle Bin (Bug #58887).

  • Add functionality to the UMC Client to allow skipping SSL hostname verification for local connections (Bug #55576).

System services#

SAML#

  • The UID User Federation mapper is now created with the “Always Read Value From LDAP” setting enabled by default. This establishes LDAP as the single source of truth for UIDs, bypassing Keycloak’s local database cache on every request (Bug #59040).

  • The univention-keycloak script introduced a flag to enable the “Always Read Value From LDAP” setting for new User Federation Mappers (Bug #59040).

Mail services#

  • A defect in the Fetchmail listener module has been resolved. The issue prevented the Fetchmail service from restarting correctly after user configuration changes, which prevented emails from being sent or received (Bug #59036).

IMAP services#

  • The logrotate configuration for reloading rsyslog has been fixed (Bug #58551).

Services for Windows#

Samba#

  • Since kernel 4.19, the sysvol-sync could fail after reboots with the message cannot create /var/lock/sysvol-sync-dir: Permission denied. This update fixes this issue (Bug #58784).

Univention S4 Connector#

  • The Univention S4 connector now supports restoring objects from the UDM Recycle Bin also in Samba/AD (Bug #58844).

Univention Active Directory Connection#

  • univention-adsearch only supported LDAPS against port 636, but not StartTLS against port 389. Now it also supports the latter (Bug #57747).

  • Only consider permitted enctypes when synchronizing Kerberos keys from AD supplementalCredentials. This avoids a compatibility issue with the new sha256 and sha384 hash types generated by Windows Server 2025 until we apply the fix for the issue in OpenLDAP (Bug #57747).

  • Renaming a user object with umlauts in AD led to a connector reject. The update fixes this issue (Bug #58793).

  • In the modify operation also move object in UCS if position has changed in AD (Bug #58793).

  • Ignore order of multi-value attributes when checking for changed attributes (Bug #58793).

  • Avoid unnecessary object mapping before checking for changed attributes (Bug #58793).

  • Avoid ldap.ALREADY_EXISTS if move target exists in UCS (Bug #58793).

  • During DN mapping, look up samaccountname for olddn from adcache (Bug #58793).

  • Skip resync of reject for uSNCreated if lower than uSNChanged (Bug #58793).

  • Add AD reject reason to reject database. The reason will be shown in the univention-adconnector-list-rejected tool (Bug #58793).

  • The Univention AD connector now supports restoring objects from the UDM Recycle Bin also in Active Directory (Bug #58844).

Other changes#

  • When setting up a new printer in CUPS via IPP Everywhere, the printer model name is now correctly queried from the printer via IPP (Bug #58874).

  • The package univention-provisioning-service has been added. It ships a listener module that pushes new transactions into the Provisioning Service App. This package will be installed automatically when installing the new Provisioning Service UCS App (Bug #58973).

  • The listener module nubus-provisioning.py is now capable of reconnecting to NATS without a restart of the listener being necessary (Bug #58991).

On this page