Same AD Domain but new AD Domain Controller

UCS - Univention Corporate Server
#1

Hi!
After some time using UCS 5 joined to a Windows 2003 based Active Directory, somebody changed the domain controller from that server to a new one, Windows 2022 based.
I already changed all entries I found on the UCR from the old IP address, and old hostname of the Windows 2003 server, to the new one, the Windows 2022 server.
My concern is about if there is something else I need to run in order to continue using UCS sync’ed with Active Directory, because I see on the /var/log/univention/connector-ad-status.log the following messages:

 --- connect failed, failure was: ---
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/univention/admin/uldap.py", line 463, in __init__
    self.lo = univention.uldap.access(host, port, base, binddn, bindpw, start_tls, uri=uri, follow_referral=follow_referral)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 303, in __init__
    self.__open(ca_certfile)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 405, in __open
    self.bind(self.binddn, self.bindpw)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 220, in _decorated
    return func(self, *args, **kwargs)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 317, in bind
    self.lo.simple_bind_s(self.binddn, self.bindpw)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 1215, in simple_bind_s
    res = self._apply_method_s(SimpleLDAPObject.simple_bind_s,*args,**kwargs)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 1197, in _apply_method_s
    return func(self,*args,**kwargs)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 444, in simple_bind_s
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 749, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 756, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 329, in _ldap_call
    reraise(exc_type, exc_value, exc_traceback)
  File "/usr/lib/python3/dist-packages/ldap/compat.py", line 44, in reraise
    raise exc_value
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 313, in _ldap_call
    result = func(*args,**kwargs)
ldap.INVALID_CREDENTIALS: {'desc': 'Invalid credentials'}

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/univention/connector/ad/main.py", line 247, in main
    connect(options)
  File "/usr/lib/python3/dist-packages/univention/connector/ad/main.py", line 119, in connect
    ad.init_ldap_connections()
  File "/usr/lib/python3/dist-packages/univention/connector/ad/__init__.py", line 541, in init_ldap_connections
    super(ad, self).init_ldap_connections()
  File "/usr/lib/python3/dist-packages/univention/connector/__init__.py", line 523, in init_ldap_connections
    self.open_ucs()
  File "/usr/lib/python3/dist-packages/univention/connector/__init__.py", line 550, in open_ucs
    self.lo = univention.admin.uldap.access(host=host, port=port, base=self.configRegistry['ldap/base'], binddn=binddn, bindpw=bindpw, follow_referral=True)
  File "/usr/lib/python3/dist-packages/univention/admin/uldap.py", line 465, in __init__
    raise univention.admin.uexceptions.authFail(_("Authentication failed"))
univention.admin.uexceptions.authFail: Authentication Failed: Authentication failed.

 ---     retry in 30 seconds      ---

root@radon:/var/log/univention#

Any ideas?
Thanks, and best regards,

HeCSa.

#2

Hi,
your issue might be down to the “functional level” of your Windows AD/DC. The samba version 4.18 used in UCS -5.0 currently only supports functional level up to 2008R2.
Try to reduce the functional level on your Windows-DC and see if it works.
With UCS-5.2, recently announced for Feb. '25, it’s expected to get also a newer version of samba that can cope with more recent versions of Windows Server.
Cheers,
Frank

#3

Hi Frank,
Thanks for your quick reply.
The issue was that the ldap.secret in some update was “modified”…hopefully we had a backup of the previous file, so as a test we changed it, and the messages dissapeared.
Now we are dealing with the user sync, I’ll check how to change de funtional level of the Windows AD/DC to Windows 2008R2 to see if it works syncing users.
Thanks a lot again, I’ll put here the updates of this strange issue (the new one!).
Best regards,
HeCSa.

Mastodon