Release notes for the installation and update of Univention Corporate Server (UCS) 5.2-7

Release notes for the installation and update of Univention Corporate Server (UCS) 5.2-7#

Publication date of UCS 5.2-7: 2026-09-22

Release highlights#

Univention Corporate Server 5.2-7 is available. It includes feature improvements, extensions, and bug fixes. The following overview highlights the most important changes:

New RADIUS authentication helper:

WLAN authentication with username and password through the Nubus RADIUS service uses an authentication helper plugin internally. This helper has caused high CPU consumption in large environments. A rewrite of the helper module in Rust reduces CPU consumption and increases the number of authentications that each UCS installation can process. For more information, see Bug #59042.

New Guardian backend based on Cerbos:

The Nubus Authorization Service, called Guardian, now uses the open source solution Cerbos as its backend. It replaces the Open Policy Agent (OPA) backend. Cerbos includes features that Guardian needs to make authorization decisions. More information about the authorization decisions will become available in the Univention public blog shortly after this release. Besides the Cerbos backend, the Authorization Service is now available as a component of UCS, packaged as a Debian package that contains a container. This simplifies setup and maintenance compared with the former Docker Compose-based App Center app.

Improved handling of password hashes and optional removal of weaker hashes:

In preparation for the removal of weaker password hashes, UCS 5.2-7 integrates several improvements. UDM now has more configuration options to define which hashing algorithms to use during password storage. These options let you remove weaker hashes that are still stored for compatibility reasons. The Active Directory Connection now supports more configurations in which Active Directory is configured with reduced encryption types.

Keycloak Metrics:

The Keycloak app now lets you activate the integrated “Metrics Endpoint” in Keycloak. Administrators can get detailed information about Keycloak usage and events in their Prometheus and Grafana dashboards. For more information, see Monitoring Keycloak with metrics in Univention Keycloak app documentation [1].

Education Classes support in the Microsoft 365 Connector:

The Microsoft 365 Connector now lets you activate “educational classes” in Microsoft 365. Administrators of Nubus or UCS@school can decide which groups to activate automatically, so that they don’t need to administer the feature manually in Microsoft 365. For more information, see Education Classes in Univention Corporate Server - Manual for users and administrators [2].

Notes about the update#

Before updating, test the update in a separate test environment that’s identical to your production environment. Run the update in a maintenance window, because some services in the domain can be unavailable temporarily.

The update can take anywhere from 30 minutes to several hours, depending on system performance, network connection, and installed software. For large environments, consult UCS performance guide [3].

Password authentication for deactivated accounts#

As of UCS 5.2-7, deactivating a user account no longer invalidates its password hash. UCS enforces account deactivation during an LDAP bind. A server-side check rejects deactivated accounts.

Warning

Services that use password-lookup mode can still authenticate deactivated accounts. To prevent access, update their authentication configuration.

The following UCS-supported services and apps aren’t affected and require no operator changes:

  • Services that authenticate through an LDAP bind.

  • Services that use token- or OIDC-based authentication.

  • OX App Suite on UCS.

  • Standard UCS mail services.

Password-lookup services read the userPassword hash and verify it locally instead of performing a user bind. For example, Dovecot uses password-lookup mode without auth_bind = yes.

If you operate a service that uses password-lookup mode, do one of the following:

  1. Switch to LDAP bind authentication. For example for Dovecot, set auth_bind = yes.

  2. Update the LDAP lookup filter to exclude deactivated accounts, for example, by using (!(krb5KDCFlags:1.2.840.113556.1.4.803:=128)).

Updating multiple UCS systems#

In environments with multiple UCS systems, the Primary Directory Node must always be the first system in the update order during a release update.

For more information about planning updates in multi server environments, see Planning updates in multiserver environments in Nubus for UCS 5.2 - Operation Manual [4].

Simultaneous operation of UCS and Debian on UEFI systems#

Simultaneous operation of UCS and Debian GNU/Linux on UEFI systems isn’t supported in UCS 5.0 and later.

The GRUB boot loader of Univention Corporate Server uses the same configuration files as Debian. If Debian is already installed, UCS can’t boot after you install or update to UCS 5.0. Conversely, installing Debian after you install UCS 5.0 prevents UCS from booting.

For more information, refer to KB 17768.

Prepare for an update#

This section covers important considerations before you update.

Sufficient disk space#

Ensure you have sufficient disk space for the update. A standard installation requires 6 to 10 GB. The update process requires an additional 1 to 2 GB to download and install packages, depending on your existing installation size.

Console usage for update#

Sign in to the system’s local console as root and run the update. Alternatively, you can run the update using Univention Management Console.

If you run the update over a network connection, take steps to ensure that the update continues if the connection is interrupted. Network interruptions can cancel the update, which severely affects the system.

Use tools such as tmux, screen, or at to keep the update running through network interruptions. All UCS system roles have these tools installed by default.

Script to check for known update issues#

Univention provides a script that checks for problems that could prevent a successful update. You can download the script before the update and run it on the UCS system.

# download
$ curl -OOf https://updates.software-univention.de/download/univention-update-checks/pre-update-checks-5.2-7{.gpg,}

# verify and run script
$ apt-key verify pre-update-checks-5.2-7{.gpg,} && bash pre-update-checks-5.2-7

...

Starting pre-update checks ...

Checking app_appliance ...                        OK
Checking block_update_of_NT_DC ...                OK
Checking cyrus_integration ...                    OK
Checking disk_space ...                           OK
Checking hold_packages ...                        OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
...

Post processing of the update#

After the update, run new or updated join scripts. Either use the Domain join management module in the Management UI or run univention-run-join-scripts as root.

Verify that the join scripts completed successfully. Then restart the UCS system.

Notes on selected packages#

The following sections cover selected packages for this update.

Collection of usage statistics#

When you use UCS Core Edition, UCS collects anonymous usage statistics for Univention Management Console. The system logs which modules you open to a Matomo instance. These statistics help Univention improve Univention Management Console development based on customer needs.

You can verify the license status through the menu entry License ‣ License information in the user menu of Univention Management Console. If the License information lists UCS Core Edition under License type, your UCS system is using UCS Core Edition.

UCS doesn’t collect usage statistics if you use an Enterprise Subscription license such as UCS Base Subscription or UCS Standard Subscription.

To deactivate usage statistics collection, set the Univention Configuration Registry Variable umc/web/piwik to false.

Changelog#

You can find the changes since UCS 5.2-6 in Changelog for Univention Corporate Server (UCS) 5.2-7.

Bibliography#

[1]

Univention Keycloak app documentation. Univention GmbH, 2023. URL: https://docs.software-univention.de/keycloak-app/latest/.

[2]

Univention Corporate Server - Manual for users and administrators. Univention GmbH, 2021. URL: https://docs.software-univention.de/manual/5.2/en/.

[3]

UCS performance guide. Univention GmbH, 2021. URL: https://docs.software-univention.de/ext-performance/5.2/en/.

[4]

Nubus for UCS 5.2 - Operation Manual. Univention GmbH, 2025-2026. URL: https://docs.software-univention.de/ucs-operation/5.2/en/.

On this page