UCS 5.2-2 Release Notes

Download PDF

Release notes for the installation and update of Univention Corporate Server (UCS) 5.2-2

Release notes for the installation and update of Univention Corporate Server (UCS) 5.2-2#

Publication date of UCS 5.2-2: 2025-06-12

Release highlights#

With Univention Corporate Server 5.2-2, the second patch level release for Univention Corporate Server 5.2 is available. It provides several feature improvements and extensions, properties, as well as, bug fixes. Here is an overview of the most important changes:

  • Univention Corporate Server 5.2-2 introduces the univentionObjectIdentifier: a globally unique identifier for all objects managed via Univention Directory Manager. It simplifies object mapping to external systems and ensures consistent tracking across logs. The identifier is auto-generated for new objects; existing objects receive it during upgrade.

  • Keycloak 26 is now available in the App Center with enhanced security and new features. It comes with a new Ad Hoc Provisioning plugin which automatically creates Nubus user accounts. This enables seamless Single Sign-On access across connected applications for identities logging in via trusted external IdPs (e.g., Active Directory).

  • Univention Corporate Server 5.2-2 delivers major performance gains in Univention Directory Manager, notably for deleting computer objects and editing groups in large environments. A new diagnostic tool identifies LDAP database fragmentation — a key bottleneck in older, large deployments — and provides remediation guidance.

  • Various components of the Univention Management Console and App Center were hardened against cross-site scripting (XSS) attacks through stricter content sanitization and improved HTML encoding.

  • Univention Corporate Server 5.2-2 includes numerous security updates for packages such as curl, glibc, intel-microcode, openssl, firefox-esr, Linux kernel, and many others to ensure protection against the latest vulnerabilities.

Notes about the update#

Run the update in a maintenance window, because some services in the domain may not be available temporarily. It’s recommended that you test the update in a separate test environment before the actual update. The test environment must be identical to the production environment.

Depending on the system performance, network connection, and installed software, the update can take anywhere from 30 minutes to several hours. For large environments, consult UCS performance guide [1].

Initialization and indexing of the univentionObjectIdentifier#

During update an LDAP equality index is created for the univentionObjectIdentifier and for each object of class univentionObject the value of entryUUID is used to initialize the attribute in case it is not yet present. Depending on the amount of objects in the LDAP directory and limiting I/O factors this may take some time.

Please note that in Nubus environments with mixed UCS versions prior to Univention Corporate Server 5.2-2, the UDM on the old systems will not know how to properly manage the attribute for all kinds of univentionObject. Univention Corporate Server 5.2-2 contains a plugin for UMC System Diagnostic to check if all objects have the attribute and to fix those that don’t.

Simultaneous operation of UCS and Debian on UEFI systems#

Please note that simultaneous operation of UCS and Debian GNU/Linux on a UEFI system starting with UCS 5.0 isn’t supported.

The reason for this is the GRUB boot loader of Univention Corporate Server, which partly uses the same configuration files as Debian. An already installed Debian leads to the fact that UCS can’t boot (anymore) after the installation of or an update to UCS 5.0. A subsequent installation of Debian results in UCS 5.0 not being able to boot. For more information, refer to KB 17768.

Preparation of update#

This section provides more information you need to consider before you update.

Sufficient disk space#

Also verify that you have sufficient disk space available for the update. A standard installation requires a minimum of 6-10 GB of disk space. The update requires approximately 1-2 GB additional disk space to download and install the packages, depending on the size of the existing installation.

Console usage for update#

For the update, sign in on the system’s local console as user root, and initiate the update there. Alternatively, you can conduct the update using Univention Management Console.

If you want or have to run the update over a network connection, ensure that the update continues in case of network disconnection. Network connection interrupts may cancel the update procedure that you initiated over a remote connection. An interrupted update procedure affects the system severely. To keep the update running even in case of an interrupted network connection, use tools such as tmux, screen, and at. All UCS system roles have these tools installed by default.

Script to check for known update issues#

Univention provides a script that checks for problems which would prevent the successful update of the system. You can download the script before the update and run it on the UCS system.

# download
$ curl -OOf https://updates.software-univention.de/download/univention-update-checks/pre-update-checks-5.2-2{.gpg,}

# verify and run script
$ apt-key verify pre-update-checks-5.2-2{.gpg,} && bash pre-update-checks-5.2-2

...

Starting pre-update checks ...

Checking app_appliance ...                        OK
Checking block_update_of_NT_DC ...                OK
Checking cyrus_integration ...                    OK
Checking disk_space ...                           OK
Checking hold_packages ...                        OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
...

Post processing of the update#

Following the update, you need to run new or updated join scripts. You can either use the UMC module Domain join or run the command univention-run-join-scripts as user root.

Subsequently, you need to restart the UCS system.

Please verify the PostgreSQL version on all UCS systems that updated to UCS 5.2. As UCS 5.2 ships Version 15 of PostgreSQL, updated systems may need migration from PostgreSQL 11. For the recommended migration steps, see KB 22162.

Notes on selected packages#

The following sections inform about some selected packages regarding the update.

Collection of usage statistics#

When using the UCS Core Edition, UCS collects anonymous statistics on the use of Univention Management Console. The modules opened get logged to an instance of the web traffic analysis tool Matomo. Usage statistics enable Univention to better tailor the development of Univention Management Console to customer needs and carry out usability improvements.

You can verify the license status through the menu entry License ‣ License information of the user menu in the upper right corner of Univention Management Console. Your UCS system is a UCS Core Edition system, if the License information lists UCS Core Edition under License type.

UCS doesn’t collect usage statistics, when you use an Enterprise Subscription license such as UCS Base Subscription or UCS Standard Subscription.

Independent of the license used, you can deactivate the usage statistics collection by setting the Univention Configuration Registry Variable umc/web/piwik to false.

Changelog#

You find the changes since UCS 5.2-0 in Changelog for Univention Corporate Server (UCS) 5.2-2.

Bibliography#

[1]

UCS performance guide. Univention GmbH, 2021. URL: https://docs.software-univention.de/ext-performance/5.2/en/.

On this page