'univentionFetchmailProtocol' not allowed

Apps & App Center
#1

Hello,
I am on Univention Corporate Server 5.0.3 and installed the fetchmail from the app center a long time ago.
When I want to save changed user attributes I get the following error message, even when this user never had fetchmail configured and I do not want to change these attributes at all.

The LDAP object could not be saved: LDAP Error: Object class violation: attribute ‘univentionFetchmailProtocol’ not allowed.

I suppose that the attribute field only can have the two options IMAP and POP3. But when I change the contents I must also fill in the other parameters as Remote Server and username and password.

Pleas change the definition for fetchmaiProtocol to accept empty values.
Regards, Peter

Error in system diagnostics after each UCS update
#2

I had the same issue. AFAIK the attribute is legacy and was only attached no non-fechtmail accounts. You can identify these accounts via univention-ldapsearch univentionFetchmailProtocol=IMAP dn.

You can delete the attribute via

ldapmodify -D "cn=admin,$(ucr get ldap/base)" -y /etc/ldap.secret <<__LDIF__
dn: $dn_of_object
changetype: modify
delete: univentionFetchmailProtocol
-
__LDIF__
1 Like
#3

Hello,
and thanks for the hint.

Same for “Object class violation: attribute ‘univentionFetchmailUseSSL’ not allowed.”?

Best regards,
TP

#4

Yes. The working entries are now stored in the new attribute univentionFetchmailSingle. The migration is probably done by the fechtmail joinscript but it ignores all non-working entries.

1 Like
#5

Aaaand same for “univentionFetchmailKeepMailOnServer”

You know what?
You have helped me to solve a problem, which for some unknown reason started today at about 4 o’clock in the morning and has been bothering me ever since:

14.03.2023 04:53:58.232 LDAP        (PROCESS): sync AD > UCS: [          user] [    modify] 'uid=somename,ou=somesub,ou=users,ou=mybusiness,dc=domain,dc=local'
14.03.23 04:53:58.285  ADMIN       ( WARN    ) : The attribute 'entryCSN' is not allowed by any object class.
14.03.2023 04:53:58.287 LDAP        (ERROR  ): Unknown Exception during sync_to_ucs

Since then, little by little, more and more users without fetchmail - even those used for service purposes only - have had S4 rejects.

Fortunately, Prometheus Monitoring brought this to my attention.

I would never have associated this with the old fetchmail attributes, because this was not immediately visible for me in /var/log/univention/connector-s4.log…

Really weird that it started without any intervention (also no UCS update immediately before) on my part.

:pray: many, many thanks :pray:

TP

#6

Maybe the respective errata updates could have triggered the S4 error, @scheinig?

https://forge.univention.org/bugzilla/show_bug.cgi?id=55682
https://forge.univention.org/bugzilla/show_bug.cgi?id=55766
https://forge.univention.org/bugzilla/show_bug.cgi?id=55681

Best regards,
TP

#7

Hello SirTux,
ldapmodify and delete univentionFetchmailProtocol was the solution for my problem.
Thank you!
Regards, Peter

1 Like
#8

Hi,
I would not say “triggered”, but I have got an other report about the connector reject, and created an other Bug:
https://forge.univention.org/bugzilla/show_bug.cgi?id=55882

1 Like
#9

Hello,
i have the same issue.
but ldapmodify return with error
“ldap_modify: Server is unwilling to perform (53)
additional info: modify upon the root DSE not supported”
Anay idea ?
Thanks and regards
Martin

#10

Hello I find an easier method to correct this problem.
I also get error with ldapmodify
“ldap_modify: Server is unwilling to perform (53)
additional info: modify upon the root DSE not supported”

You need at least UCS Server 5.0-3 errata 619

So I go to Domain / Domain Join / 92univention-fetchmail-schema
Force Execute

And the problem is solved

Best regards Stephan

#11

Hello Stefan,
many thanks this solved the problem.
Best regards Martin

#12

I have not made any manual changes to the LDAP yet. I have the error message “‘univentionFetchmailProtocol’ not allowed” e.g. with the user “scan”. This is only for the scanner to write to the share.

ldapmodify -D "cn=scan,$(ucr get ldap/base)" -y /etc/ldap.secret <<__LDIF__
dn: $dn_of_object
changetype: modify
delete: univentionFetchmailProtocol
-
__LDIF__

I copy this command on the master so directly into the console? Including the underscores?

with best
sven

#13

Yes!

Beitrag muss mindestens 20 Zeichen lang sein

#14

Worked :slight_smile: … twenty characters …

Mastodon