For Nubus for UCS

6.2. For Nubus for UCS#

The OX Connector app architecture includes the following elements:

  • The Nubus for UCS operating environment includes the App Center and Docker Engine. A container runs OX Connector.

  • The container image contains the OX Connector software.

  • The OpenLDAP directory in Nubus for UCS is the identity management source for OX App Suite.

Before you continue reading, ensure you know Shared architecture.

6.2.1. Overview#

The OX Connector uses the software in its container image to provision identity data from Nubus for UCS to OX App Suite. The OX Connector connects to the OX App Suite SOAP API. It creates, updates, or deletes OX App Suite objects, including users, groups, contexts, and resources, in response to relevant LDAP directory changes. Fig. 6.4 shows the following components, their boundaries, and dependencies:

  1. Identity Store and Directory Service

  2. Directory Manager

  3. Provisioning Service

  4. Provisioning API

  5. OX Connector Provisioning Consumer

  6. OX App Suite

OX Connector app architecture

Fig. 6.1 OX Connector app architecture#

Detailed OX Connector app processing, click to open.

Fig. 6.2 includes the Provisioning Service with all its parts and what happens there before the data moves to the OX Connector. Follow the Flow relations from the top right corner to the OX App Suite.

OX Connector app architecture

Fig. 6.2 OX Connector app architecture in more detail#

Click the diagram to zoom in.

6.2.2. How the connector works#

Univention Directory Manager (UDM) is an object layer on top of the LDAP directory in UCS. The OX Connector reacts to changes in the following UDM modules:

  • Source modules:

    • users/user

    • groups/group

  • Connector-specific modules:

    • oxmail/oxcontext

    • oxresources/oxresources

    • oxmail/accessprofile

    • oxmail/functional_account

    • oxmail/shared_account

    • oxmail/shared_account_permission

The connector processes changes to these modules and sends data to the SOAP API in OX App Suite when required.

6.2.2.1. Access profiles#

When the oxmail/accessprofile UDM module changes, the connector rewrites the local file /var/lib/univention-appcenter/apps/ox-connector/data/ModuleAccessDefinitions.properties. It doesn’t send access-profile data directly to the SOAP API in OX App Suite. When the connector provisions a user, it applies the access-profile definitions from this file through the SOAP API.

Administrators can find access profiles in the Management UI, in the LDAP directory module, at open-xchange ‣ accessprofile.

6.2.2.2. Provisioning#

For a visualization of the provisioning process, see Fig. 6.3. The following steps describe how the OX Connector provisions changed UDM objects to OX App Suite:

  1. The Provisioning Service detects a change in the Identity Store and Directory Service and sends a message with the UDM object through the Provisioning API.

  2. In the container, the OX Connector Provisioning Consumer receives the message and stores it as a task in its SQLite database.

  3. The OX Connector Provisioning Consumer processes tasks in a fixed module order and sends the data for each task to the SOAP API in OX App Suite.

  4. After the SOAP API successfully processes the data, the OX Connector Provisioning Consumer stores the object state in its database of old entries. For more information, see Database of stored object state.

  5. After a connection error, the connector stops processing tasks and retries later. For other errors, it moves the task to the morgue.

provisioning procedure

Fig. 6.3 Provisioning procedure#

6.2.3. Provisioned attributes#

For information about configuring the user attribute mapping, see User attribute mapping.

For the related group, context, and resource provisioning implementations, see the following files:

  • univention-ox-provisioning/univention/ox/provisioning/groups.py

  • univention-ox-provisioning/univention/ox/provisioning/contexts.py

  • univention-ox-provisioning/univention/ox/provisioning/resources.py

6.2.4. Database of stored object state#

Added in version 3.0.0.

The OX Connector stores its database file at /var/lib/univention-appcenter/apps/ox-connector/data/ox-connector.db. The database contains a table named old. Don’t modify the database file directly.

Listing 6.1 shows how to inspect pending tasks on the Nubus for UCS system. The command displays a summary of the pending tasks.

For more information about provisioning tasks, see Manage provisioning tasks.

Listing 6.1 Inspect pending OX Connector tasks.#
$ univention-app shell ox-connector \
  python3 -m univention.ox.provisioning.db summarize-tasks
On this page