After upgrade to 5.2: self-service page shows "403 - Forbidden"

[kcadmin]

After upgrade to 5.2-0 errata22 the page to reset the password via self-service shows the Apache 403 Forbidden page.

It was working with the prior version 5.0-9.
What can I do to bring it back?

TIA!

EDIT
Apache error log:
[Tue Feb 11 15:00:33.681765 2025] [autoindex:error] [pid 109209:tid 109209] [client x.x.x.x:55851] AH01276: Cannot serve directory /var/www/univention/self-service/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive, referer: https://mydomain/univention/portal/

This directory indeed doesn’t have any index file:

ls -lah /var/www/univention/self-service/
insgesamt 16K
drwxr-xr-x 4 root root 4,0K 11. Feb 16:23 .
drwxr-xr-x 5 root root 4,0K 11. Feb 16:25 ..
drwxr-xr-x 2 root root 4,0K  6. Feb 11:08 css
drwxr-xr-x 2 root root 4,0K 11. Feb 16:23 icons

But this one has:

ls -lah /var/www/univention/selfservice
lrwxrwxrwx 1 root root 28  2. Mai 2022  /var/www/univention/selfservice -> /usr/share/univention-portal

ls -lah -H /var/www/univention/selfservice
insgesamt 156K
drwxr-xr-x   7 root root    4,0K  6. Feb 11:36 .
drwxr-xr-x 337 root root     12K  6. Feb 12:08 ..
drwxr-xr-x   2 root root    4,0K  6. Feb 11:36 css
-rw-r--r--   1 root root    2,4K  2. Mai 2022  custom.css
-rw-------   1 root root    2,4K  2. Mai 2022  custom.css.bak
-rw-r--r--   1 root root     59K  9. Dez 09:58 feather-sprite.svg
drwxr-xr-x   2 root root    4,0K  6. Feb 11:36 fonts
drwxr-xr-x   2 root root    4,0K  6. Feb 11:36 i18n
drwxr-xr-x   5 root root    4,0K  5. Mai 2017  icons
-rw-r--r--   1 root root    2,7K  9. Dez 09:58 index.html
drwxr-xr-x   2 root root    4,0K  6. Feb 11:36 js
-rw-r--r--   1 root root     348  9. Dez 09:58 key.svg
-rw-r--r--   1 root root     362  9. Dez 09:58 login.svg
-rw-r--r--   1 root nogroup   47  2. Mai 2022  portal.css
-rw-rw----   1 root root    8,4K  2. Mai 2022  portals.json
-rw-r--r--   1 root root    1,9K  9. Dez 09:58 questionMark.svg
-rw-r--r--   1 root root    1,9K  9. Dez 09:58 sse-worker.js
-rw-r--r--   1 root root    4,9K  9. Dez 09:58 univention-blog.png
-rw-r--r--   1 root root    5,7K  9. Dez 09:58 univention-management-console.svg

[jlk]

Hey,

just to be sure: What was the exact path used to access the self service? To clarify: The Self Service was integrated into the Portal quite some time ago, with that a dedicated portal called selfservice was provided, meaning that the self service can be reached via https://example.com/univention/selfservice/#/ - On UCS 4.4 there was https://example.com/univention/self-service/ (difference is selfservice instead of self-service), which was technically an UMC module and not a dedicated portal.

That should explain what you are seeing: The first one are left-overs from the old self service module, the latter is the portal of the new one.

Could you try to open the self service as written above without a hyphen? It should look like this:

Regards
Jan-Luca

[kcadmin]

Thanks for the answer!

My portal URL is the following: https://mydomain/univention/portal/#/

The URL behind the “Passwort ändern” is: https://mydomain/univention/self-service/#page=passwordchange

So this obviously points to the wrong URL, because here I get the 403 error.

If I correct the URL manually to https://mydomain/univention/selfservice/#/ it works.

Maybe I didn’t understand it, but what do I need to do to show the correct URL in the portal?
This installation of UCS is pretty old, from around 2016 and has always been upgraded to the newest versions, maybe it’s a leftover?

[jlk]

Indeed, I would also guess that this is a left-over - You should be able to change the link of the tile by editing your portal (either via the Edit Mode on the bottom of the side bar or via UDM), but you can also just add the portal tiles seen in your second picture to your domain portal - So you can either redirect to the second portal or just add the functionality to your regular one, as you prefer.

Regards
Jan-Luca

[kcadmin]

Thanks for your help, there it was!