Changelog for Univention Corporate Server (UCS) 5.2-7

Changelog for Univention Corporate Server (UCS) 5.2-7#

General#

  • Univention Corporate Server 5.2-7 includes the following updated packages from Debian 12.15:

    • appstream

    • beets

    • ca-certificates

    • dcmtk

    • debian-installer

    • ghdl

    • gss

    • indi-orion-ssg3

    • jackson-core

    • kernel-wedge

    • libapache-session-browseable-perl

    • libass

    • libcaca

    • libdbd-csv-perl

    • libgd-perl

    • libhtml-gumbo-perl

    • libmatio

    • libtext-csv-xs-perl

    • linux-base

    • linuxcnc

    • llvm-toolchain-22

    • mistral

    • node-regexpp

    • nvidia-settings

    • ojalgo

    • okular

    • openslide

    • phpunit

    • rlottie

    • ruby-css-parser

    • sentry-python

    • sslh

    • swift

    • sylpheed

    • sympa

    • u-boot

    • wolfssl

Basic system services#

Univention Configuration Registry#

  • The C library of UCR now supports arbitrary variable value lengths instead of cutting the values at 1024 chars (Bug #51864).

Other system services#

  • univention-ssh now deactivates SSH public key authentication when authenticating with machine account credentials. This avoids authentication failures caused by excessive SSH authentication attempts. Further security-related configuration options for joined systems have been added (Bug #59144).

Domain services#

  • The server_password_change utilities no longer print Bad file descriptor error messages when invoked through Debian post-installation scripts. In this case, the utilities write debug output to standard error instead (Bug #56630).

  • Database connection and authentication failures no longer produce repeated Python tracebacks during system installation. The failures are now logged as concise error messages (Bug #51671).

OpenLDAP#

  • The configuration of the OpenLDAP memberof overlay moved into the univention-ldap-server package. The univention-ldap-overlay-memberof package is now an empty transitional package. You can safely remove it (Bug #47464).

  • The LDAP server could crash during a simple bind when an account using the {KINIT} password scheme had no krb5PrincipalName attribute or when a Kerberos lookup failed. Repeated bind attempts could also leak memory, and temporary password data was not always completely cleared. The LDAP overlay module now handles these cases safely, releases Kerberos resources correctly, and clears the complete temporary password buffer (Bug #59920).

  • The LDAP server could crash during concurrent simple binds using the {KINIT} password scheme because authentication requests shared Kerberos state. Each bind now uses an isolated Kerberos context, preventing memory corruption and ensuring that authentication resources are released safely (Bug #59921).

  • Disabling a user account no longer invalidates the password hash stored in the LDAP attribute userPassword. This allows the Keycloak Identity Provider to distinguish a disabled account from invalid credentials and report the appropriate authentication error. The shadowbind LDAP overlay is now mandatory to ensure that disabled user accounts cannot authenticate using LDAP bind (Bug #59898).

Listener/Notifier domain replication#

  • The directory replication OID skip list now contains the built-in schema definitions from OpenLDAP 2.6 to allow mixed environments with UCS 5.3 (Bug #59532).

  • The Univention Directory Listener shutdown handling is now signal-safe to avoid segmentation faults when terminating while embedded Python handler code is active (Bug #59541).

LDAP Directory Manager#

  • Paginated searches returned an empty result when requesting a page number that isn’t larger than the previously requested one, for example when navigating back to a previous page (Bug #59466).

  • The performance of object searches using opened=0 has been improved. The API now avoids loading and decoding full UDM objects when it only requests object metadata. This significantly speeds up large search result sets (Bug #59579).

  • The UDM module search API has been extended to allow passing opened=True for UDM modules which support it (Bug #59579).

  • Total user-count metrics now exclude system accounts (Bug #59634).

  • The opened query parameter of the object search was missing from the OpenAPI/Swagger schema and is now included (Bug #59575).

  • The UDM HTTP REST API command line doesn’t depend on the UCR default layer anymore for compatibility with Nubus for Kubernetes (Bug #59837).

  • The experimental delegative administration feature can cause UDM functionality to crash when it processes invalid LDAP data. UDM now ignores affected properties during delegative administration evaluation (Bug #59560).

  • The performance of object processing has been improved by reducing the overhead of mapping LDAP attributes to UDM properties. In environments with many objects, such as when retrieving large result sets through the UDM HTTP REST API, this noticeably speeds up object retrieval (Bug #59578).

  • The syntax validation for Guardian role values has been relaxed. Role identifiers are no longer restricted to the previous app:namespace:role format, allowing arbitrary role strings to be used (Bug #59603).

  • The generation of the sambaNTPassword LDAP attribute can now be deactivated through the UCR variable password/samba/nthash. When deactivated, existing NT hashes are removed during the next password change. Be aware that this breaks services relying on NT password hashes, including S4/AD Connector password synchronization, Squid NTLM authentication, and RADIUS MS-CHAP/NTLM authentication (Bug #59607).

  • The --list-dns option of univention-license-check was broken by erratum 394 and has been repaired (Bug #59633).

  • The order of extended attributes in the layout has been corrected in cases where no built-in layout elements exist for a custom tab. UDM now displays custom groups and properties in a consistent and predictable order (Bug #48612).

  • The default authorization role udm:default-roles:helpdesk-operator for the experimental delegative administration feature was missing read permissions for mandatory user properties (username, lastname, primaryGroup, unixhome, mailForwardCopyToSelf). This caused errors when opening or saving user objects in UMC as a helpdesk operator (Bug #59673).

Univention Management Console#

Univention Management Console web interface#

  • When users deselect a single item from an all-selected state, the grid header select all checkbox now displays the unselected state instead of the indeterminate state (Bug #59147).

  • The DOMpurify library has been upgraded to the latest version (2.5.9, Bug #59808).

Univention App Center#

  • The App Center has been adapted to be compatible with future ruamel.yaml API deprecations (Bug #59521).

  • The App Center UMC module is now able to handle the installation of new dependencies during the upgrade of an app (Bug #59717).

  • Apps that can be installed multiple times in the domain can now specify whether to install first on the Primary Directory Node (Bug #59895).

  • An internal flag for univention-app register listener has been added. This allows the forced removal of a listener module and the listener-trigger service (Bug #59919).

Modules for system settings / setup wizard#

  • The system setup no longer selects the univention-ldap-overlay-memberof package for installation, as the OpenLDAP memberof overlay configuration is now part of the univention-ldap-server package (Bug #47464).

  • Automatic DNS updates of the SSO record during IP address changes now correctly honor the UCR variable keycloak/server/sso/autoregistration (Bug #59759).

  • The IP address registration during system startup no longer incorrectly reports a host’s existing IP address as already in use (Bug #53252, Bug #59759).

User management#

  • The Self Service now uses clearer wording for the email address used for account recovery (Bug #59583).

System diagnostic module#

  • The error message for the 11_nameserver check was broken and has been corrected (Bug #59489).

  • The 20_check_share_references check now only runs on the Primary Directory Node. It binds as the machine account, which on a UCS@school school replica may not read the objects of other schools, so shares referencing a server of another school were incorrectly reported as dangling references (Bug #59718).

LDAP directory browser#

  • Set * as default search value when automatic substring search is deactivated (Bug #59444).

  • The performance of object searches using opened=0 has been improved. The API now avoids loading and decoding full UDM objects when it only requests object metadata. This significantly speeds up large search result sets (Bug #59579).

  • The experimental paginated object search supports LDAP Server Side Sorting (SSS) with either Simple Paged Results (SPR) or Virtual List View (VLV). Use this feature for evaluation only. Univention doesn’t support it for production use yet. Known limitations affect scalability, process-local pagination state, and recovery after LDAP server restarts. To use VLV, enable the LDAP SSSVLV overlay and configure it correctly (Bug #50240).

  • Empty search queries now always return all results (Bug #59595).

Univention base libraries#

  • You can configure the timeout for LDAP extension activation in ucs_registerLDAPExtension through the UCR variable directory/manager/ldap_extension/timeout/activation (Bug #59474).

  • Authentication retry handling in the UMC client has been corrected. Previously, under certain authentication failures, the client could repeatedly retry authentication until it reached the Python recursion limit. The retry logic now performs a limited number of authentication attempts before reporting the authentication failure to the caller (Bug #58380).

System services#

SAML#

  • The SAML integration now supports API changes in newer python-keycloak versions (Bug #59517).

  • The crudesaml package epoch has been increased to ensure a valid upgrade path to UCS 5.3 and restore the original upstream package version (Bug #59511).

Mail services#

IMAP services#

  • UCS 5.3 upgrades with Dovecot 2.4 now use the UCR template /etc/dovecot/conf.d/90-sieve-extprograms.conf to write a compatible configuration file (Bug #59520).

RADIUS#

  • The username of the inner tunnel is now passed to the default connection. For example, this allows assigning a VLAN based on this authenticated username instead of inheriting unverified settings from the outer tunnel (“anonymous login”, Bug #59456).

  • The performance of NTLM authentication with RADIUS has been significantly improved, reducing authentication times and CPU load under high request volumes. The univention-radius-ntlm-auth helper has been rewritten in Rust for this purpose (Bug #59042).

PAM / Local group cache#

  • Printing with iPads could cause CUPS to hang or slow down the print dialog. The pam_krb5 Kerberos authentication step is now skipped in the PAM auth stack when the service is cups, preventing unnecessary Kerberos lookups during CUPS authentication (Bug #59552).

Networking services#

  • During system startup, IP address registration now retries temporary communication failures while Univention Management Console services are still starting instead of failing (Bug #53252).

Services for Windows#

Samba#

  • Windows domain trust validation could fail because winbindd got stuck attempting an SMB connection that Microsoft Active Directory neither required nor permitted. For example, this occurred when Active Directory enabled Require NTLMv2 session security (Bug #59601).

  • Samba 4.24 now lets Windows clients open symbolic links (Bug #59706).

Univention S4 Connector#

  • The S4 Connector now retries primary group synchronization after the corresponding group becomes available in Samba/AD (Bug #52788).

Univention Active Directory Connection#

  • During password synchronization to UCS, the univention-ad-connector now sets the msDS-SupportedEncryptionTypes attribute in Active Directory only for bidirectional synchronization configurations (Bug #59692).

  • The AD Connector now retries primary group synchronization after the corresponding group becomes available in AD (Bug #59694).

  • The allowfilter and ignorefilter settings from the AD Connector now support basic substring matching for values, for example *string* (Bug #59701).

  • During password synchronization from Active Directory to UCS, the AD Connector now synchronizes Kerberos keys by default. This lets UCS use more secure key types after a password change in Active Directory (Bug #57689).

Other changes#

  • The Python LDAP client now correctly preserves the LDAP Virtual List View (VLV) search context between requests. This significantly improves the performance of repeated VLV requests and reduces server load when applications use VLV-based pagination, such as the experimental pagination feature of the UDM HTTP REST API (Bug #59666).

  • The Cerbos Python SDK provides Python clients for accessing Cerbos. In UCS, it supports HTTP only, not gRPC (Bug #59901).

  • This is the first release of the Cerbos-based Guardian component for UCS. It replaces the OPA-based Guardian and is intended for use only with Univention software. There is no upgrade path from the OPA-based Guardian to the new component. This update removes the OPA-based Guardian, so you don’t need to take any action (Bug #59669).

On this page