Active Directory offers an operating mode called read-only domain controller (RODC) with the following properties:

A comprehensive description can be found in the Microsoft TechNet Library [technet-rodc].

A Samba 4 domain controller can be operated in RODC mode (on a slave domain controller for example). Prior to the installation of univention-samba4, the Univention Configuration Registry variable samba4/role must be set to RODC:

ucr set samba4/role=RODC
univention-install univention-samba4
univention-run-join-scripts

The removal of an Samba 4 domain controller (Active Directory-compatible domain controller) is a far-reaching configuration step and should be prepared thoroughly.

If the domain should continue to be provide Active Directory-compatible services, the univention-samba4 package must remain installed on the master domain controller or a backup domain controller system.

Before uninstalling the packages, the domain controller registration must be removed from the Samba 4 database. This can be done with the helper script purge_s4_computer.py. It must be run on the master domain controller or a backup domain controller system. The query Really remove master from Samba 4? must be answered with Yes and the question Really remove master from UDM as well? must be answered with No. e.g:

root@backup:~# /usr/share/univention-samba4/scripts/purge_s4_computer.py --computername=master
Really remove master from Samba 4? [y/N]: Yes
If you are really sure type YES and hit enter: YES
Ok, continuing as requested.

[...]
Removing CN=MASTER,CN=Computers,$ldap_BASE from SAM database.
Really remove master from UDM as well? [y/N]: No
Ok, stopping as requested.

root@backup:~#

The Univention S4 connector must be run on the master domain controller or a backup domain controller in the domain. After Samba 4 was uninstalled, the join script of the S4 connector (97univention-s4-connector) script should be re-executed on the master domain controller or a another backup domain controller. This can be done via the Univention Management Console module Domain join:

§

Figure 1.1. Re-execute S4 connector join script

The FSMO (Flexible Single Master Operations) roles should be checked. In case the roles were provided by the removed DC, they must be transferred, for example:

root@backup:~# samba-tool fsmo show
InfrastructureMasterRole owner: CN=NTDS Settings,CN=MASTER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dom
RidAllocationMasterRole owner: CN=NTDS Settings,CN=MASTER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dom
PdcEmulationMasterRole owner: CN=NTDS Settings,CN=MASTER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dom
DomainNamingMasterRole owner: CN=NTDS Settings,CN=MASTER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dom
SchemaMasterRole owner: CN=NTDS Settings,CN=MASTER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dom

root@backup:~# samba-tool fsmo seize --role=all --force
Will not attempt transfer, seizing...
FSMO transfer of 'rid' role successful
Will not attempt transfer, seizing...
FSMO transfer of 'pdc' role successful
Will not attempt transfer, seizing...
FSMO transfer of 'naming' role successful
Will not attempt transfer, seizing...
FSMO transfer of 'infrastructure' role successful
Will not attempt transfer, seizing...
FSMO transfer of 'schema' role successful
root@backup:~#

It is possible to synchronize several separate Active Directory domains with one UCS directory service (e.g. to synchronize with an AD forest). One OU (organizational unit) can be defined in LDAP for each AD domain, under which the objects of the respective domains are synchronized. The configuration of further connector instances is not covered by the UMC module.

Several connector instances are started parallel to each other. Each connector instance is operated with a self-contained configuration base. The prepare-new-instance script is used to create a new instance, e.g.:

/usr/share/univention-ad-connector/scripts/prepare-new-instance -a create -c connector2

This script creates an additional init script for the second connector instance (/etc/init.d/univention-ad-connector2), a configuration directory /etc/univention/connector2 with a copy of the mapping settings of the main connector instance (this can be adapted if necessary) and an array of internal runtime directories.

The additional connector instances are registered in the Univention Configuration Registry variable connector/listener/additionalbasenames.

If SSL is used for the connection encryption, the exported Active Directory certificate must be converted via openssl into the required format, for example:

openssl x509 -inform der -outform pem -in infile.cer -out ad-connector2.pem

The file name of the converted certificate then needs to be stored in Univention Configuration Registry:

univention-config-registry set \
   connector2/ad/ldap/certificate=/etc/univention/ad-connector2.pem

If a UCS synchronization is performed towards Active Directory, the replication of the listener module must be restarted after a further connector instance is created. To this end, the following command must be run:

univention-directory-listener-ctrl resync ad-connector

The command line tools which belong to the AD Connector such as univention-adsearch support selecting the connector instance with the parameter -c.