Maybe someone could help to identify where this information gets usual parsed from? XML file is received when ‘https://ucsserver.domain/univention/saml/metadata’ is called. I don’t know if this information will be build by the script or if some UCR entry should be present.
Btw same issue end of 2023 → Keycloak install problem
I did some further deep dive to debug why the expected URL is not set correctly. At the very end of the scipt /usr/sbin/univention-keycloak I found the source of information been used for the URL.
https://{opt.umc_saml_sp_server}/univention/saml/metadata
I check the registry for umc/saml/sp-server and found no entry. Compared to a clean test system the result is identical, but on the test system the script runs without any issues. As per description this registry key is empty by default. That’s why I could not find any difference when I did my first comparison.
The simple solution was to fill this reg key with the FQDN of the master controller. Not sure if this is only applicable for environments with backup controller/s, but in my case it was.
I am sorry for not reacting until now.
Also while recall the issue and my post, do not quite remember how I solved it. It for sure involved dissecting the the join script step by step.
Of note, that my setup also includes primary and secondary nodes, and many replica nodes too.
I now checked and the sp-server is empty, but have all server listed one by one as umc/saml/trusted/sp/ucs-xxx.domain.
I am glad that you were able to solve it.
1 Like