Problem
The join script 40univention-office365.inst fails while creating a Keycloak SAML client:
CREATING KEYCLOAK SAML CLIENT.....
keycloak.exceptions.KeycloakPostError: 403: b'You got banned permanently from this server.'
40univention-office365.inst: EXITCODE=1
Investigation
The error occurs when univention-keycloak requests an authentication token from Keycloak.
Check whether a reverse proxy blocks requests using the Python HTTP client User-Agent:
SSO="$(ucr get ucs/server/sso/uri)"
UA="$(python3 -c 'import requests; print(requests.utils.default_user_agent())')"
curl -si "${SSO%/}/realms/master/.well-known/openid-configuration"
curl -si -A "$UA" "${SSO%/}/realms/master/.well-known/openid-configuration"
If the request using the Python User-Agent returns HTTP 403 with the message You got banned permanently from this server., inspect the reverse proxy’s bot protection rules.
Root Cause
NGINX bot protection was enabled and blocked HTTP requests using the python-requests User-Agent.
The univention-keycloak command uses the Python Keycloak library, causing its authentication requests to be rejected before the SAML client can be created.
Solution
Adjust the NGINX bot protection configuration to allow the required Python-based requests from trusted UCS systems to Keycloak.
Prefer a targeted exception instead of disabling bot protection globally.
After applying the configuration change, rerun the affected join script:
univention-run-join-scripts --run-scripts 40univention-office365.inst
Verify that the join script completes successfully and no longer returns HTTP 403.