6.5. Recycle Bin

Added in version 5.2-3-erratum-298: Since UCS 5.2 erratum 298, Univention Corporate Server (UCS) supports a Recycle Bin feature for user and group objects in Univention Directory Manager (UDM).

The Recycle Bin temporarily stores deleted directory objects in UDM. Administrators who accidentally remove UDM objects can restore them with the data preserved in the Recycle Bin.

When you activate a Recycle Bin policy, UDM moves deleted objects to the Recycle Bin container before removing them from the LDAP directory. UDM preserves the original object data and metadata about the deletion. You can view existing Recycle Bin entries in Univention Management Console (UMC), UDM, and the UDM HTTP REST API. You can restore entries before UDM purges them after the configured retention time.

This section describes how to activate, configure, and manage the Recycle Bin. It also provides information about automatically purging entries, configuration, and logging.

6.5.1. Limitations

The Recycle Bin has the following limitations:

• The Recycle Bin supports only the UDM types users/user and groups/group.

• The Recycle Bin is available only in Nubus for UCS.

6.5.2. Activate the Recycle Bin

To activate the Recycle Bin, you need administrator privileges and access to the Primary Directory Node and all Backup Directory Nodes.

1. On the Primary Directory Node and all Backup Directory Nodes, set the UCR variable listener/module/recyclebin/deactivate to false. For instructions about setting UCR variables, see Configure the local system with Univention Configuration Registry.

2. Restart the Univention Directory Listener on the Primary Directory Node with the command in Listing 6.21.

   Listing 6.21 Restart the Univention Directory Listener

   $ systemctl restart univention-directory-listener
   

   Important

   If you activate the Recycle Bin after creating user or group objects, the Recycle Bin doesn’t include them because the listener cache has no association with those objects. Deleting those objects doesn’t add them to the Recycle Bin.

3. To include user and group objects that existed before you activated the Recycle Bin, run the command in Listing 6.22 on the Primary Directory Node. The command restarts the Univention Directory Listener and reinitializes only the Recycle Bin.

   Important

   Reinitialization doesn’t change objects or create entries in the Recycle Bin. While reinitialization runs, the Univention Directory Listener doesn’t process other directory changes on the Primary Directory Node. The Univention Directory Listener processes pending directory changes after reinitialization.

   Reinitialization can’t recover deleted objects that existed before you activated the Recycle Bin.

   Important

   In large environments, reinitialization can take longer. Schedule it during a period of low load or a maintenance window.

   Listing 6.22 Restart Univention Directory Listener to reinitialize only the Recycle Bin

   $ univention-directory-listener-ctrl resync recyclebin
   

4. To verify that reinitialization is complete, run the command in Listing 6.23. Confirm that the recyclebin listener module has state 3. State 3 indicates that the module is fully initialized and ready. If the module has a different state, verify that listener/module/recyclebin/deactivate is set to false and read /var/log/univention/listener.log. You can restart the Univention Directory Listener with the command in Listing 6.21.

   Listing 6.23 Check the listener status

   $ univention-directory-listener-ctrl status
   

6.5.3. Recycle Bin policy

Administrators can configure the Recycle Bin with one or more Recycle Bin policies. For instructions about creating and linking policies, see Policies.

After you create a Recycle Bin policy and link it to a container object in the LDAP directory, the Recycle Bin configuration applies to all objects within the container. Before removing an object, UDM checks whether a policy applies and moves the object to the Recycle Bin.

The Recycle Bin policy has the following configuration properties:

Recycle Bin enabled

Defines whether the Recycle Bin is active for objects. Even if a container has a linked Recycle Bin policy, you can deactivate it.

UDM modules to recycle

Defines a list of UDM module types that the Recycle Bin policy applies to, such as users/user or groups/group.

Ignored object classes

Defines a list of LDAP object classes that are exceptions for the Recycle Bin. If an administrator deletes an object and the object matches any of these object classes, UDM doesn’t move the object to the Recycle Bin container.

Retention days

Defines the retention time in days that UDM keeps objects in the Recycle Bin before permanently removing them. Set the retention time to a value between the values of the UCR variables ldap/database/internal/overlay/dds/min-ttl and ldap/database/internal/overlay/dds/max-ttl.

6.5.4. Manage objects in the Recycle Bin

Administrators can manage entries in the Recycle Bin with the Recycle Bin management module or with the command-line tool udm and the UDM module recyclebin/removedobject. For instructions about UDM operations, see Command-line interface for domain management.

The following actions are available:

• List all existing entries in the Recycle Bin.

• Delete entries permanently.

• Restore entries.

Restoring an entry from the Recycle Bin adds it to the LDAP database with the data preserved in the Recycle Bin. For user objects, this data includes passwords and group memberships.

6.5.5. Automatically purge entries in the Recycle Bin

UDM creates entries in the Recycle Bin if an administrator removes a UDM object and the Recycle Bin policy applies to it.

The policy defines the retention time. The Recycle Bin entry inherits this value as its time-to-live property. The value must be within the range that ldap/database/internal/overlay/dds/min-ttl and ldap/database/internal/overlay/dds/max-ttl define. UDM purges Recycle Bin entries when their time-to-live value expires. You can’t restore purged entries.

In Nubus for UCS, the Dynamic Directory Services (DDS) overlay of the OpenLDAP server purges expired entries.

6.5.6. Configuration through UCR

Configure the Recycle Bin with the following UCR variables on the Primary Directory Node:

• listener/module/recyclebin/deactivate

• ldap/database/internal/overlay/dds/min-ttl

• ldap/database/internal/overlay/dds/max-ttl

For the variable reference and default values, see UCR variable reference.

Important

To restart the LDAP service, complete the following steps:

1. Verify that the UCS domain meets the following conditions:

   • No mass import of user data is in progress, for example through UCS@school, or connector initialization with the Active Directory Connection or the S4 Connector.

   • No UCS system is joining the domain.

   • No system or app upgrades are running.

   • Listeners and connectors are idle.

2. Restart the LDAP server on the Primary Directory Node with the command in Listing 6.24.

   Listing 6.24 Restart the LDAP server

   $ systemctl restart slapd.service
   

3. Verify that the LDAP server is active with the command in Listing 6.25.

   Listing 6.25 Verify that the LDAP server is active

   $ systemctl is-active slapd.service
   

6.5.7. Logging information

The following log files contain entries about creating Recycle Bin entries and restoring objects:

/var/log/univention/listener.log on the Primary Directory Node

Contains entries about creating Recycle Bin entries.

/var/log/univention/management-console-module-udm.log

Contains entries about restoring objects with UMC.

/var/log/univention/directory-manager-rest.log

Contains entries about restoring objects with the UDM HTTP REST API.