Do i need SimpleSamlPHP?

[Allyfied]

Hi,
we are running an UCS Server on 5.0.10. Update to 5.2 would be great and therefore we uninstalled all nomore used software like Kopano, Z-Push, Nextcloud etc. The only thing this server should do is to be an AD comptible Domain-Controller and Filseserver.

For now the update to 5.2 is not working, because of a strange missing of a SimpleSamlPHP certificate. Error in Diagnose:
Zertifikat https://ucs-sso.blablabla.local/simplesamlphp/saml2/idp/certificate konnte nicht geladen werden: Unable to load certificate.Zertifikat https://192.168.xxx.xxx/simplesamlphp/saml2/idp/certificate konnte nicht geladen werden: Unable to load certificate. Führen Sie das Join-Skript 92univention-management-console-web-server via [Modul "Domänenbeitritt"](javascript:void(0)) oder univention-run-join-scripts --force --run-scripts 92univention-management-console-web-server auf der Befehlszeile as Benutzer *root* aus.

This error is there for ages (the machine is 8 years old now), but as everything worked great, i did not care. When i try to install KeyCloak it is ending up in a mess and the portal website will not be displayed due certificate errors in Apache.

As i read somewhere in this Forum, Keycloak is not needed to run the AD Domain Controller. So may i just uninstall SimpleSamlPHP? And how is this done, because it’s not visible in the App Center and it is also marked as not installed in Paket-Verwaltung.

So if it isn’t installed, why does is it disturbing the upgrade?

Thanks in advance.

[MiracErde]

Hi @Allyfied,

Maybe the following articles could be help you:

Problem:UCS 5.2 - all php packages are removed since the upgrade

Problem Since the upgrade to UCS 5.2 all php packages have been removed. In UCS 5.2 Keyloak is used for SSO and therefore simpleSAMLphp is no longer supported and all packages are removed during the upgrade. Solution If you still need PHP you can simply install them as follows, but please note that they are completely not supported. apt install php8.2 dpkg -l | grep php ii php8.2 8.2.26-1~deb12u1 all serv…

QA: Is Keycloak Required for the Upgrade to UCS 5.2?

Question: Is Keycloak required for the upgrade to UCS 5.2, and does the migration from SimpleSAMLphp have to be performed? Answer: Starting with UCS 5.2, Keycloak becomes the default single sign-on (SSO) identity provider, replacing SimpleSAMLphp. During the upgrade to UCS 5.2, all packages related to SimpleSAMLphp and univention-saml are removed. For details, see the related article: Problem: UCS 5.2 – All PHP packages are removed since the upgrade Important Note If your environmen…

How-to: Best Practice for Upgrading to UCS 5.2

Best Practices for Upgrading to UCS 5.2 Upgrading to Univention Corporate Server (UCS) 5.2 is a major system upgrade that involves multiple UCS versions, two Debian release upgrades, kernel changes, and internal data migrations. This article provides practical guidance, highlights common pitfalls, and explains why a step-by-step upgrade approach is strongly recommended to minimize risk and downtime. 1. General Recommendation You do need to be careful when upgrading to UCS 5.2. From practical …

Best regards,
MiracErde

[Allyfied]

Thank you. I will try again next weekend.
But i like to know, if KeyCloak ist not needed for a simple domain controller and fileserver, how can i uninstall the simpleSAML and ucs-sso stuff?

[MiracErde]

Hi @Allyfied,

Thank you for your response.

If you dont want to use SingleSignOn on your environment, you will need Keycloak. But if you won’t use any SingleSignOn, you just have to complete the migration part for keycloak, to delete old and not necassary SimpleSamlPHP stuff.
This is the part from the article, you will need:
1. Complete the Keycloak Migration

Best regards,
MiracErde