Move from DC to sub containers/folders in LDAP -> does this work correctly?

Hello all,

i using UCS 4.4. I’ve created some containers under DC in LDAP. So every rule should be inherited. If i move all the domaincontrollers from DC in subfolders (Master, Nextcloud, Kopano…) is this a problem for some path’s? Or work this without problems? Because i must add some packageservers (for offlineupdates) for different locations, so i have to split all the DC’s. Same with the memberservers.

Thanks :slight_smile:

Each UCS server knows its own DN and uses that to bind to the LDAP directory for all of its services. Therefore moving the server object in the LDAP requires updating that information on the server whose object was moved. I’m not sure if that is done automatically; I doubt it somewhat.

Luckily this should be easy enough as the DN is stored in the UCR variable ldap/hostdn. Personally I’d following a process such as:

  1. Log in to the server whose object you want to move via ssh & become root
  2. Move the server object in the LDAP directory
  3. Update the UCR variable ldap/hostdn on the server: ucr set ldap/hostdn=<new DN>
  4. Forcefully rebuild all configuration files from templates via ucr commit (just in case)
  5. Reboot the server (easiest way to make sure all services using that information are restarted)

Note that when you move your DC Master’s object, the UMC will most likely cease to work almost instantly as the UMC uses the server’s host DN for authenticating any type of LDAP access, too. After a reboot things should be fine again, though.

This applies to a regular server. Things will be slightly different for Dockerized apps. Apps from the app center often come as Docker images which actually run a UCS member or slave server inside Docker. Therefore there are server objects for those “hosts”, too; they’re called <shortened appname>-<random suffix>. For those all changes to the UCR variable must be done from inside the Docker container. You can spawn a shell into the app container with univention-app shell <appname>, e.g. univention-app shell nextcloud

1 Like

Very Thanks Moritz_Bunkus,

i know this can be complicated. I think it is a good i idea to test this in a testenv before i do this in production.

For the first: Nice Weekend :slight_smile:

Mastodon