Hello. I want to have the ability to allow users to changer their “mailPrimaryAddress” instead of “e-mail” via self-service.
I know about the pros and cons by using mailPrimaryAddress instead of e-mail as UDM attribute, but since I am using UCS only as directory server this is fine for me.
My UCR settings look like this:
- self-service/ldap_attributes: jpegPhoto,mailPrimaryAddress,mail,telephoneNumber,st,homePostalAddress
- self-service/udm_attributes: jpegPhoto,mailPrimaryAddress,phone,homePostalAddress
I have also disabled the filter for mailPrimaryAddress, which enforced the mail-domain to match a managed domain of the domain controler before
ucr set directory/manager/web/modules/users/user/properties/mailPrimaryAddress/syntax=string
service univention-management-console-server restart
While I am now able to set an arbitrary mailPrimaryAddress via the user manager, I can not change my mail via the self-service plugin.
Whenever I enter a new mail in self-service, I get “Error 400 - Bad Request” in my browser.
The logs show this
/var/log/univention/management-console-web-server.log
23.02.22 15:37:57.707 MAIN ( PROCESS ) : CPCommand (192.168.0.4:34176) response status code: 400
23.02.22 15:37:57.707 MAIN ( PROCESS ) : CPCommand (192.168.0.4:34176) response reason : None
23.02.22 15:37:57.707 MAIN ( PROCESS ) : CPCommand (192.168.0.4:34176) response message: Die Attribute konnten nicht gespeichert werden: Zugriff verweigert. Konnte die Sperrzeit von u'cn=new@mail.com,cn=mailPrimaryAddress,cn=temporary,cn=univention,dc=XXX,dc=XXX,dc=XXX' nicht modifizieren.
23.02.22 15:37:57.707 MAIN ( PROCESS ) : CPCommand (192.168.0.4:34176) response result: None
23.02.22 15:37:57.707 MAIN ( PROCESS ) : CPCommand (192.168.0.4:34176) response error: {'traceback': None, 'command': 'set_user_attributes'}
/var/log/univention/management-console-module-passwordreset.log
3.02.22 15:39:09.499 MODULE ( PROCESS ) : Loading python module.
23.02.22 15:39:09.792 MODULE ( PROCESS ) : Imported python module.
23.02.22 15:39:09.792 MODULE ( PROCESS ) : Module instance created.
23.02.22 15:39:09.792 MODULE ( PROCESS ) : Module socket initialized.
23.02.22 15:39:09.809 MODULE ( PROCESS ) : Setting user LDAP DN None
23.02.22 15:39:09.809 MODULE ( PROCESS ) : Setting auth type to None
23.02.22 15:39:09.809 MODULE ( PROCESS ) : Initializing module.
23.02.22 15:39:09.818 MODULE ( PROCESS ) : get_plugins(): Loaded sending plugin class 'VerifyEmail' for sending method 'verify_email'.
23.02.22 15:39:09.825 MODULE ( PROCESS ) : get_plugins(): Loaded sending plugin class 'SendEmail' for sending method 'email'.
23.02.22 15:39:09.832 MODULE ( PROCESS ) : get_plugins(): Plugin class 'SendSMS' for sending method 'mobile' is disabled.
23.02.22 15:39:09.836 MODULE ( PROCESS ) : get_plugins(): Plugin class 'SendWithExternal' for sending method 'None' is disabled.
23.02.22 15:39:09.836 MODULE ( PROCESS ) : get_plugins(): plugin class 'VerifyEmail' for sending method 'verify_email': udm_property: 'PasswordRecoveryEmailVerified' token_length: '64'
23.02.22 15:39:09.836 MODULE ( PROCESS ) : get_plugins(): plugin class 'SendEmail' for sending method 'email': udm_property: 'PasswordRecoveryEmail' token_length: '64'
23.02.22 15:39:09.945 MODULE ( ERROR ) : set_user_attributes(): modifying the user failed: Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/univention/management/console/modules/passwordreset/__init__.py", line 508, in set_user_attributes
user.modify()
File "/usr/lib/python2.7/dist-packages/univention/admin/handlers/users/user.py", line 1480, in modify
return super(object, self).modify(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/univention/admin/handlers/__init__.py", line 633, in modify
self._ldap_pre_ready()
File "/usr/lib/python2.7/dist-packages/univention/admin/handlers/users/user.py", line 1695, in _ldap_pre_ready
self.request_lock('mailPrimaryAddress', self['mailPrimaryAddress'])
File "/usr/lib/python2.7/dist-packages/univention/admin/handlers/__init__.py", line 1691, in request_lock
value = univention.admin.allocators.request(self.lo, self.position, name, value)
File "/usr/lib/python2.7/dist-packages/univention/admin/allocators.py", line 209, in request
return acquireUnique(lo, position, type, value, _type2attr[type], scope=_type2scope[type])
File "/usr/lib/python2.7/dist-packages/univention/admin/allocators.py", line 198, in acquireUnique
univention.admin.locking.lock(lo, position, type, value.encode('utf-8'), scope=scope)
File "/usr/lib/python2.7/dist-packages/univention/admin/locking.py", line 102, in lock
raise univention.admin.uexceptions.permissionDenied(_('Can not modify lock time of %r.') % (dn,))
permissionDenied: Konnte die Sperrzeit von u'cn=new@mail.com,cn=mailPrimaryAddress,cn=temporary,cn=univention,dc=XXX,dc=XXX,dc=XXX' nicht modifizieren.
23.02.22 15:39:09.946 MODULE ( PROCESS ) : Die Attribute konnten nicht gespeichert werden: Zugriff verweigert. Konnte die Sperrzeit von u'cn=new@mail.com,cn=mailPrimaryAddress,cn=temporary,cn=univention,dc=XXX,dc=XXX,dc=XXX' nicht modifizieren.
I have basically no idea, why it fails. Deleting and recreating the LDAP entry in univention/temporary did not resolve this. What am I doing wrong?
