UCS 5.0-9 Release Notes

Download PDF

Release notes for the installation and update of Univention Corporate Server (UCS) 5.0-9

Release notes for the installation and update of Univention Corporate Server (UCS) 5.0-9#

Publication date of UCS 5.0-9: 2024-09-24

Release highlights#

With Univention Corporate Server 5.0-9, the ninth patch level release for Univention Corporate Server (UCS) 5.0 is available. It provides several feature improvements and extensions, new properties, as well as, various improvements and bug fixes. Here is an overview of the most important changes:

  • Single sign-on (SSO) is a central element of integrated identity and access management (IAM). The Nubus Identity Provider already supports the most important protocols, SAML and OpenID Connect (OIDC). With Univention Corporate Server 5.0-9, OIDC is now also available for the UCS web interfaces, in particular the portal and the Univention Management Console (UMC). In addition to the migration to the newer SSO mechanism, OIDC in UCS 5.0-9 enables new functions such as the “Back-channel Logout”, which supports a Single Logout (SLO) without user interaction. To improve the user experience, an automatic update of the portal content in all open tabs after a logout ensures that the logged out state is displayed correctly everywhere.

  • The Active Directory Connection synchronizes users, groups, and computer objects between Nubus and Active Directory (AD). With UCS 5.0-9, selective synchronization has been fundamentally revised. It now enables flexible control of the synchronized objects on the basis of allow and deny filters, both at the level of entire sub trees and individual object types. The improved selection ensures that the AD Connection synchronizes only the needed objects, which avoids unwanted entries on both sides and minimizes manual effort.

  • UCS 5.0-9 includes various security updates, for example for apache2, BIND9, OpenJDK-11, dovecot, postgresql, systemd and the Linux-5.10 kernel.

Notes about the update#

Run the update in a maintenance window, because some services in the domain may not be available temporarily. It’s recommended that you test the update in a separate test environment before the actual update. The test environment must be identical to the production environment.

Depending on the system performance, network connection, and installed software, the update can take anywhere from 20 minutes to several hours. For large environments, consult UCS performance guide [1].

UCS only available for 64 bit#

UCS 5 is only available for the x86 64 bit architecture amd64. Existing 32 bit UCS systems can’t update to UCS 5.

Simultaneous operation of UCS and Debian on UEFI systems#

Please note that simultaneous operation of UCS and Debian GNU/Linux on a UEFI system starting with UCS 5.0 isn’t supported.

The reason for this is the GRUB boot loader of Univention Corporate Server, which partly uses the same configuration files as Debian. An already installed Debian leads to the fact that UCS can’t boot (anymore) after the installation of or an update to UCS 5.0. A subsequent installation of Debian results in UCS 5.0 not being able to boot. For more information, refer to KB 17768.

Local package repository#

This section is relevant for environments with a local repository. The installed major version of UCS determines which packages a local repository provides. A repository running on a UCS server with version 4.x only provides packages up to UCS 4.x, a repository server running on UCS 5 only provides packages for UCS 5 and later.

To upgrade systems to UCS 5 in an environment with a local repository, consider the following options. First, you need to set up a local UCS 5 repository server.

  • Install a new UCS 5 system as a Primary Directory Node from the DVD or from a virtualized base image. Then setup a local repository on this system as described in Univention Corporate Server - Manual for users and administrators [2].

  • Install a new UCS 5 system with the system role Backup Directory Node, Replica Directory Node or Managed Node from the DVD or from a virtualized base image. In system setup, select that the system doesn’t join a domain. Then set up a local repository on this system as described in Univention Corporate Server - Manual for users and administrators [2]. After you updated the Primary Directory Node used in the domain to UCS 5, the UCS 5 repository server can join the domain through univention-join.

To upgrade a system in the domain to UCS 5, first update the server to the latest package level available for UCS 4.x. Then switch the repository server used by the system to the local UCS 5 repository by changing the Univention Configuration Registry Variable repository/online/server. You can now upgrade the system to UCS 5 through the Univention Management Console or through the command line.

Preparation of update#

This section provides more information you need to consider before you update.

Python 3.7 compatibility#

Before you update, verify manually crafted Python code for compatibility with Python 3.7 and adjust it accordingly. This includes Univention Configuration Registry templates containing Python code. Customized AD-Connector mapping templates are an example for this. For advice, see also the Univention Developer Reference [3].

AD Connector mapping#

When you operate multiple instances of the AD Connector as described in Synchronization of several Active Directory domains with one UCS directory service, you need to adjust the mapping configuration and ensure Python 3.7 compatibility before the update. KB 17754 describes the steps.

Sufficient disk space#

Also verify that you have sufficient disk space available for the update. A standard installation requires a minimum of 6-10 GB of disk space. The update requires approximately 1-2 GB additional disk space to download and install the packages, depending on the size of the existing installation.

Console usage for update#

For the update, sign in on the system’s local console as user root, and initiate the update there. Alternatively, you can conduct the update using Univention Management Console.

If you want or have to run the update over a network connection, ensure that the update continues in case of network disconnection. Network connection interrupts may cancel the update procedure that you initiated over a remote connection. An interrupted update procedure affects the system severely. To keep the update running even in case of an interrupted network connection, use tools such as tmux, screen, and at. All UCS system roles have these tools installed by default.

Script to check for known update issues#

Univention provides a script that checks for problems which would prevent the successful update of the system. You can download the script before the update and run it on the UCS system.

# download
$ curl -OOf https://updates.software-univention.de/download/univention-update-checks/pre-update-checks-5.0-9{.gpg,}

# verify and run script
$ apt-key verify pre-update-checks-5.0-9{.gpg,} && bash pre-update-checks-5.0-9

...

Starting pre-update checks ...

Checking app_appliance ...                        OK
Checking block_update_of_NT_DC ...                OK
Checking cyrus_integration ...                    OK
Checking disk_space ...                           OK
Checking hold_packages ...                        OK
Checking ldap_connection ...                      OK
Checking ldap_schema ...                          OK
...

Post processing of the update#

Following the update, you need to run new or updated join scripts. You can either use the UMC module Domain join or run the command univention-run-join-scripts as user root.

Subsequently, you need to restart the UCS system.

Notes on selected packages#

The following sections inform about some selected packages regarding the update.

Collection of usage statistics#

When using the UCS Core Edition, UCS collects anonymous statistics on the use of Univention Management Console. The modules opened get logged to an instance of the web traffic analysis tool Matomo. Usage statistics enable Univention to better tailor the development of Univention Management Console to customer needs and carry out usability improvements.

You can verify the license status through the menu entry License ‣ License information of the user menu in the upper right corner of Univention Management Console. Your UCS system is a UCS Core Edition system, if the License information lists UCS Core Edition under License type.

UCS doesn’t collect usage statistics, when you use an Enterprise Subscription license such as UCS Base Subscription or UCS Standard Subscription.

Independent of the license used, you can deactivate the usage statistics collection by setting the Univention Configuration Registry Variable umc/web/piwik to false.

Changelog#

You find the changes since UCS 5.0-8 in Changelog for Univention Corporate Server (UCS) 5.0-9.

Bibliography#

[1]

UCS performance guide. Univention GmbH, 2021. URL: https://docs.software-univention.de/ext-performance/5.0/en/.

[2] (1,2)

Univention Corporate Server - Manual for users and administrators. Univention GmbH, 2021. URL: https://docs.software-univention.de/manual/5.0/en/.

[3]

Univention Developer Reference. Univention GmbH, 2021. URL: https://docs.software-univention.de/developer-reference/5.0/en/.

On this page