User shall have their own (per user) primary group

Hi, I run a ucs test setup and i need to be able to create users and groups using the command line interface.
During the test i observed when I try create a test user “smithda” and a group “smithda” ONLY the one or the other is possible, as follows:

udm groups/group create \
--position "cn=groups,dc=math,dc=uzh,dc=ch" \
--set name="smithda" \
--set gidNumber="10900"

and then

udm users/user create \
--position "cn=users,dc=math,dc=uzh,dc=ch" \
--set lastname="Smith" \
--set password="qwertyu1234" \
--set username="smithda"

Then I see –
“E: Object exists: (uid) : smithda”

another observation was when I run:

udm users/user create \
--position "cn=users,dc=math,dc=uzh,dc=ch" \
--set lastname="Smith" \
--set password="qwertyu1234" \
--set username="smithda" \
--set primaryGroup="cn=10900,cn=groups,dc=math,dc=uzh,dc=ch"

Then I see –
“Need a primary group with samba option to create a user with samba option.”

The background for my question is I need that the users have their own primary group, so it should look at then end as follows:

getent group smithda
smithda: *: 10900

getent passwd smithda
smithda:x:10900:10900: Daniel   Smith:/home/smithda: /bin/bash

Thanks for your feedback.

Best Regards,
Daniel

Setup:
UCS: 4.2-3 errata305
App Center compatibility: 4
Installed: cups=1.7.5 printquota=9.0 samba4=4.6

Hey,

in a UCS system users & groups share the same name space. You simply cannot have a user and a group with the same name.

One possible way is to prefix or postfix each group with e.g. -grp, meaning you’d name the group smithda-grp and the corresponding user smithda.

Kind regards,
mosu

Hi Moritz,
well, I am bit surprised but thanks for this clarification.

Could you also help why this command

udm users/user create \
--position "cn=users,dc=math,dc=uzh,dc=ch" \
--set lastname="Smith" \
--set password="qwertyu1234" \
--set username="smithda" \
--set primaryGroup="cn=10900,cn=groups,dc=math,dc=uzh,dc=ch"

gives the output
“Need a primary group with samba option to create a user with samba option.”

What means this, why is this messages then now showed.

Best Regards
Daniel

Hi Moritz,
well, I am bit surprised but thanks for this clarification. It would be usefully to have such function for us. Does USC plans to implement such in a future release?

Could you also help why this command

udm users/user create
–position “cn=users,dc=math,dc=uzh,dc=ch”
–set lastname=“Smith”
–set password=“qwertyu1234”
–set username=“smithda”
–set primaryGroup=“cn=10900,cn=groups,dc=math,dc=uzh,dc=ch”

gives the output
“Need a primary group with samba option to create a user with samba option.”

What means this, why is this messages then now showed.

Best Regards
Daniel

Hey,

I’d guess that the error message is slightly misleading. Your primary group is most likely not named cn=10900,… but e.g. cn=smitha-grp,…. You have to use the DN of an actually existing group here; you cannot simply use the group’s ID. If you need to know the group’s DN for a given ID, use something like this: univention-ldapsearch gidNumber=10900 dn

Kind regards,
mosu

There could be two other reasons:

  • the “samba” option not set on the group (it should by default)
  • the s4 connector is not running, and thus, after creating a group, the samba attributes are not synced back from samba4

Please verify that the objectClass sambaGroupMapping is set on the group:

$ univention-ldapsearch -LLL cn=smithda objectClass
objectClass: organizationalRole
objectClass: sambaGroupMapping
objectClass: top
objectClass: univentionGroup
objectClass: univentionObject

Please post here the output of:
univention-ldapsearch -LLL '(|(cn=smithda)(cn=10900))'

Please verify that the s4 connector is running:

$ service univention-s4-connector status
● univention-s4-connector.service - LSB: Univention S4 Connector
   Loaded: loaded (/etc/init.d/univention-s4-connector)
   Active: active (running) since Di 2018-02-20 16:38:00 CET; 6 days ago
  Process: 1706 ExecStart=/etc/init.d/univention-s4-connector start (code=exited, status=0/SUCCESS)
 Main PID: 2787 (python2.7)
   CGroup: /system.slice/univention-s4-connector.service
           └─2787 /usr/bin/python2.7 -W ignore /usr/lib/pymodules/python2.7/univention/s4connector/s4/main.py

Feb 20 16:38:00 ucs26 univention-s4-connector[1706]: Starting Univention S4 Connector: univention-s4-connector.
Feb 20 16:38:00 ucs26 systemd[1]: univention-s4-connector.service: Supervising process 2787 which is not ...xits.
Feb 20 16:38:00 ucs26 systemd[1]: Started LSB: Univention S4 Connector.
Hint: Some lines were ellipsized, use -l to show in full.
$ ps ax | grep s4connector
 2787 ?        S     19:24 /usr/bin/python2.7 -W ignore /usr/lib/pymodules/python2.7/univention/s4connector/s4/main.py

Greetings
Daniel

Hi Daniel, Thanks for the reply. Please see the output.

root@ucs:/home# univention-ldapsearch -LLL ‘(|(cn=smithda)(cn=10900))’
dn: cn=smithda,cn=groups,dc=math,dc=uzh,dc=ch
sambaGroupType: 2
cn: smithda
objectClass: top
objectClass: univentionGroup
objectClass: posixGroup
objectClass: univentionObject
objectClass: sambaGroupMapping
univentionObjectType: groups/group
gidNumber: 10900
univentionGroupType: -2147483646
sambaSID: S-1-5-21-3817833853-2945879862-3432639042-1164

hi daniel, pls also see this output, Thanks a lot
root@ucs:/home# service univention-s4-connector status -l
● univention-s4-connector.service - LSB: Univention S4 Connector
Loaded: loaded (/etc/init.d/univention-s4-connector)
Active: active (running) since Sun 2018-02-25 06:25:35 CET; 4 days ago
Process: 485 ExecStop=/etc/init.d/univention-s4-connector stop (code=exited, status=0/SUCCESS)
Process: 492 ExecStart=/etc/init.d/univention-s4-connector start (code=exited, status=0/SUCCESS)
Main PID: 571 (python2.7)
CGroup: /system.slice/univention-s4-connector.service
└─571 /usr/bin/python2.7 -W ignore /usr/lib/pymodules/python2.7/univention/s4connector/s4/main.py

Feb 25 06:25:35 ucs univention-s4-connector[492]: Starting Univention S4 Connector: univention-s4-connector.
Feb 25 06:25:35 ucs systemd[1]: PID file /var/run/univention-s4-connector not readable (yet?) after start.
Feb 25 06:25:35 ucs systemd[1]: univention-s4-connector.service: Supervising process 571 which is not our child. We’ll most likely not notice when it exits.
Feb 25 06:25:35 ucs systemd[1]: Started LSB: Univention S4 Connector.

root@ucs:/home# ps ax | grep s4connector
571 ? S 5:58 /usr/bin/python2.7 -W ignore /usr/lib/pymodules/python2.7/univention/s4connector/s4/main.py
25113 pts/3 S+ 0:00 grep --color s4connector

Hey,

your group is still named smithda. Therefore creating a user with the same name won’t work, even if you specify the correct group name.

You should:

  1. rename the group so that its name won’t clash with the new user’s name (e.g. to smithda-grp; corresponding command might be udm groups/group modify --dn cn=smithda,cn=groups,dc=math,dc=uzh,dc=ch --set name=smithda-grp)
  2. create the user specifying the group’s new DN as the primaryGroup (udm users/user create … --set primaryGroup=cn=smithda-grp,cn=groups,dc=math,dc=uzh,dc=ch …)

Kind regards,
mosu

Fair point: pls see this now
root@ucs:/home# udm groups/group remove --dn “cn=smithda,cn=groups,dc=math,dc=uzh,dc=ch”
Object removed: cn=smithda,cn=groups,dc=math,dc=uzh,dc=ch

root@ucs:/home# udm groups/group create \

–position “cn=groups,dc=math,dc=uzh,dc=ch”
–set name=“smithda_g”
–set gidNumber=“10900”
Object created: cn=smithda_g,cn=groups,dc=math,dc=uzh,dc=ch
root@ucs:/home# udm groups/group list --filter name=“smith*”
name=smith*
DN: cn=smithda_g,cn=groups,dc=math,dc=uzh,dc=ch
UVMMGroup: 0
adGroupType: -2147483646
description: None
gidNumber: 10900
mailAddress: None
name: smithda_g
sambaGroupType: 2

udm users/user create
–position “cn=users,dc=math,dc=uzh,dc=ch”
–set lastname=“Smith”
–set password=“qwertyu1234”
–set username=“smithda”
–set primaryGroup=“cn=smithda_g,cn=groups,dc=math,dc=uzh,dc=ch”
Object created: uid=smithda,cn=users,dc=math,dc=uzh,dc=ch


root@ucs:/home# udm users/user list --filter uid=smith*
uid=smithda
::::
groups: cn=smithda_g,cn=groups,dc=math,dc=uzh,dc=ch
:::
primaryGroup: cn=smithda_g,cn=groups,dc=math,dc=uzh,dc=ch

This looks good to me. Both the user & the group have been created, the user’s primary group is the newly-created group.

Moritz, I give now a try again.
Thanks for your help
Regards
Daniel