UCS 5.0-0 to 5.0-1 Upgrade FAIL and recovery

UCS - Univention Corporate Server
1

I had the same problem when I went from 4.4-9 to 5.0-0. It wasn’t any fun solving it. I did get it working.

Then (dummy me) when I went to upgrade to 5.0-1 because the goal was to get back to a supported version.

So … yikes. The directory changes from 4.4-9 to 5.0 that were tolerated in 5.0-0 but no longer put up with in 5.0-1

This absolutely trashed my UCS box.

It took me hours to put humpty dumpty back together again.

Word to the wise – pay careful attention to package status in addition to boot loader condition because I ended up reinstalling every single Kopano package for UCS and redoing every ounce of plumbing from my build document.

My DB survived the implosion but that was about it. “update” killed all of the Kopano packages and they all had to be manually restored.

apt update
apt install
kopano-server
kopano-dagent
kopano-gateway
kopano-ical
kopano-spooler
kopano-monitor
kopano-presence
kopano-search
kopano-backup
kopano4ucs
kopano4ucs-schema
kopano4ucs-z-push
z-push-backend-kopano
z-push-kopano-gabsync

The root cause was old 4.4 crap that’s no longer allowed

nano /usr/lib/univention-install/70kopano4ucs-udm.inst
You’re looking for this block:

Code

--set name=kopano-role
--set module=users/user
--set module=settings/usertemplate
--set tabName=Kopano
--set tabPosition=1
--set 'shortDescription=Kopano Role (Warning: '\''None'\'' will delete Kopano user data)'
--set 'longDescription=Select the Kopano role for this user...'
--set 'translationLongDescription="de_DE" "Kopano-Rolle für dieses Benutzerobjekt wählen. Warnung: Beim Wechsel auf die Rolle \"Keine\" werden alle kopanospezifischen Daten des Benutzers gelöscht."'
--set objectClass=kopano-user

delete only: --set ‘translationLongDescription=“de_DE” “Kopano-Rolle für dieses Benutzerobjekt wählen. Warnung: Beim Wechsel auf die Rolle "Keine" werden alle kopanospezifischen Daten des Benutzers gelöscht.”’

nano /usr/lib/univention-install/70kopano4ucs-udm.inst
Remove ONLY the lines that contain:

  • translationShortDescription
  • translationLongDescription

I had There are 17 of them where I had to manually remote the entire line for each one and save it.

Then this crap… nano /usr/lib/univention-install/70kopano4ucs-udm.inst Code block:–set name=kopano-role
–set module=users/user
–set module=settings/usertemplate
–set tabName=Kopano
–set tabPosition=1
–set ‘shortDescription=Kopano Role (Warning: ‘'‘None’'’ will delete Kopano user data)’
–set ‘longDescription=Select the Kopano role for this user…’
–set ‘translationLongDescription=“de_DE” “Kopano-Rolle für dieses Benutzerobjekt wählen. Warnung: Beim Wechsel auf die Rolle "Keine" werden alle kopanospezifischen Daten des Benutzers gelöscht.”’
–set objectClass=kopano-user
…
DELETE this line: --set ‘translationLongDescription=“de_DE” “Kopano-Rolle für dieses Benutzerobjekt wählen. Warnung: Beim Wechsel auf die Rolle "Keine" werden alle kopanospezifischen Daten des Benutzers gelöscht.”’

Then the join script would finally run. univention-run-join-scripts --force --run-scripts 70kopano4ucs-udm.inst
univention-check-join-status
Joined successfully
confirm directory with: univention-ldapsearch -b “dc=yourdomain,dc=com” -LLL “(objectClass=kopano-user)” dn

review extended attributes: udm settings/extended_attribute list | grep -i kopano

Confirm: udm users/user list --filter uid=
confirm join: ucr get run/join/scripts/70kopano4ucs-udm.inst
confirm containsers: univention-ldapsearch -b “cn=kopano,dc=yourdomain,dc=com” dn

restart UDM
systemctl restart univention-directory-manager-rest

check for errors
journalctl -u univention-directory-manager-rest -n 50

verify users provisioned:
kopano-admin -l

All Kopano attributes are present and valid

You can see:

  • kopano-role: user
  • kopano-user-hidden: 0
  • MRAccept, MRProcess, MRAcceptRecurringItems, etc.
  • quota* attributes
  • Resource and ResourceCapacity

These are all the attributes created by the join script.

If even one of them were malformed, UDM would have refused to list the user.

No legacy UCS‑4 fields remain

The join script originally failed because of old fields like:

  • translationShortDescription
  • translationLongDescription

If those still existed anywhere in LDAP, UDM would have thrown errors here.

Run the udm settings/extended_attribute create command above and tell me the output.

root@blade:~# udm settings/extended_attribute create \

–position “cn=kopano,cn=custom attributes,cn=univention,dc=yourdomain,dc=com”
–set name=“kopano-role”
–set module=“users/user”
–set tabName=“Kopano”
–set tabPosition=“1”
–set shortDescription=“Kopano Role”
–set longDescription=“Select the Kopano role for this user.”
–set objectClass=“kopano-user”
–set syntax=“kopano4ucsRole”
–set mayChange=1
–set ldapMapping=“kopano4ucsRole”
–set multivalue=0
–set hook=“kopano4ucsRole”
–set default=“user”

  • the schema is consistent
  • the join script no longer injects invalid fields
  • your LDAP tree is clean

And then the packages that were yanked out by the upgrade process could be put back

systemctl status postfix
systemctl restart postfix

systemctl restart kopano-spooler
systemctl restart kopano-dagent

Then there was THIS damn problem! no en.json! nano /usr/share/univention-portal/i18n/en.json


minimal, valid English translation file (this is safe, generic, and matches the structure expected by the portal):

{
“portal”: {
“title”: “Univention Portal”,
“description”: “Welcome to your Univention Management Console”,
“login”: “Login”,
“logout”: “Logout”,
“loading”: “Loading…”,
“error”: “An error occurred while loading the portal.”
}
}


Once all of this crap was cleared up, I could verify my kernel and bootstrap and reboot and landed on a working 5.0-1 UCS server.   

5.0-2 and 5.0-3 upgraded smoothly.  5.0-4 not so much.  
The system can not be updated to UCS 5.0 due to the following reasons:

minimum_ucs_version_of_all_systems_in_domain:


ldap_connection:
        A LDAP connection to the configured LDAP servers with the machine
        account has failed (invalid credentials)!
        This MUST be fixed before the update can continue.
        This problem can be corrected by setting the content of the file
        /etc/machine.secret to the password of the computer object using
        Univention Management Console.

Error: Please check "/var/log/univention/updater.log" for details.
ERROR: update failed. Please check /var/log/univention/updater.log

A topic for another day.  

BUT if you're chasing some sense of current software version with your UCS you'll have to get to at least 5.0-10 -- and even that is dead as of Feb 2026.  

Documenting this crap because the lack of knowledge cost me huge on time.