Keycloak join script fails due to LDAP attibute error creating krbkeycloak user

UCS - Univention Corporate Server
, , ,
1

Trying to update Univention server from 5.0 to 5.2 failed with some KeyCloak/LDAP errors.
Before starting the update to 5.2 i followed the guide to switch from SimpleSAML.php to Keycloak and got it up and running with UCS 5.0. The login at the Self-Service portal was possible using SSO with Keycloak.

Now after updating to 5.2 the Join-Script for KeyCloak fails with an LDAP error on custom LDAP attributes. These custom attributes where already there with UCS 5.0 and did not pose any problem back than before the update.

LDAP Error: Invalid syntax: axiEnableAutoMigration: value #0 invalid per syntax.

This optional attribute of type boolean (1.3.6.1.4.1.1466.115.121.1.27) is one of multiple attributes defined inside a custom schema file located within /var/lib/univention-ldap/local-schema/ directory. SLAPD is running fine with it (and was before the update to 5.2).

To get more logs i modified the /usr/lib/univention-install/50keycloak.inst and added a set -x for verbose output:
The content (excerpt, domains modified) of the /var/log/univention/join.log is

...
CREATING KEYCLOAK SAML CLIENT.....
+ '[' 0 '!=' 0 ']'
+ for umc in $(univention-ldapsearch -LLL univentionService="Univention Management Console" displayName | sed -n 's/displayName: //p' | tr ";" "\n")
+ univention-keycloak --binduser admin saml/sp create --metadata-url=https://core.dom.my-domain.de/univention/saml/metadata --umc-uid-mapper
CREATING KEYCLOAK SAML CLIENT.....
+ '[' 0 '!=' 0 ']'
+ echo 'creating keycloak kerberos user'
creating keycloak kerberos user
+ spn_account_name=krbkeycloak
+ servicePrincipalName=HTTP/ucs-sso-ng.dom.my-domain.de
+ servicePrincipal=HTTP/ucs-sso-ng.dom.my-domain.de@DOM.MY-DOMAIN.DE
+ keytab_path=/var/lib/univention-appcenter/apps/keycloak/conf/keycloak.keytab
++ univention-ldapsearch -LLL uid=krbkeycloak 1.1
+ user_exists=
+ '[' -n '' ']'
++ makepasswd --chars 20
+ krb_password=abcdef123456ABCDEF
+ udm users/user create --ignore_exists --position cn=users,dc=dom,dc=my-domain,dc=de --set username=krbkeycloak --set lastname=keycloak --set password=abcdef123456ABCDEF --append objectFlag=hidden
LDAP Error: Invalid syntax: axiEnableAutoMigration: value #0 invalid per syntax.
+ die
+ echo '/usr/lib/univention-install/50keycloak.inst: FATAL: '
/usr/lib/univention-install/50keycloak.inst: FATAL: 
+ exit 2
EXITCODE=2
c60b8838-f0be-4778-8e6d-6e18ae00c5d9
RUNNING 67univention-mail-server.inst
EXITCODE=already_executed
...

Why is this script failing on optional attributes it should not modify - or even did not know of? How can i finish the update to UCS 5.2 and fix this join script?

The full LDAP definition of this attribute is:

attributeType ( 1.3.6.1.4.1.29463.2.3.184
    NAME 'axiEnableAutoMigration'
    DESC 'If true account is migrated automatically on first login'
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    EQUALITY booleanMatch
    SINGLE-VALUE
    )

Thanks,
S. Seide