Hello,
I have a fresh installation of UCS 5.0 with the latest updates and I want to use it as an authentication source VPN users. I’m using Freeradius which connects to UCS server and retrieves usernames for authentication which so far works fine when connecting tp UCS LDAP (port 7389)
I want to assign to users specific IP addresses and for this i need some custom attributes to extend the LDAP schema for User module and for this I have imported the Freeradius schema into LDAP and I was able to create the custom attributes required by Radius.
The UCS machine has also the domain controller role (Samba4) installed I need to synchronize these custom attributes between UCS LDAP and Samba. I’m using a localmapping.py script with the s4 connector to map the ucs custom attributes to Samba but it does not work. Below is an example
import univention.s4connector.s4.mapping
def mapping_hook(s4_mapping):
s4_mapping['user'].attributes['radiusFramedIPAddress'] = \
univention.s4connector.attribute(
ucs_attribute='radiusFramedIPAddress',
ldap_attribute='radiusFramedIPAddress',
con_attribute='radiusFramedIPAddress'
)
return s4_mapping
Whenever I run univention-s4connector-list-rejected command I see the below reject
UCS rejected
1: UCS DN: uid=admin,cn=users,dc=domain,dc=net
S4 DN: cn=admin,cn=users,DC=domain,DC=net
Filename: /var/lib/univention-connector/s4/1674598987.209238
S4 rejected
last synced USN: 4171
Also when I check the /var/log/univention/connector-s4.log file I see an error message constantly being displayed that the custom attribute is not being found in the schema.
25.01.2023 00:59:53.556 LDAP (PROCESS): sync UCS > AD: Resync rejected file: /var/lib/univention-connector/s4/1674598987.209238
25.01.2023 00:59:53.567 LDAP (PROCESS): sync UCS > AD: [ user] [ add] 'cn=admin,cn=users,DC=domain,DC=net'
25.01.2023 00:59:53.582 LDAP (ERROR ): sync_from_ucs: traceback during add object: cn=admin,cn=users,DC=domain,DC=net
25.01.2023 00:59:53.583 LDAP (ERROR ): sync_from_ucs: traceback due to addlist: [('objectClass', [b'top', b'user', b'person', b'organizationalPerson']), ('userAccountControl', [b'512']), ('givenName', [b'System']), ('sn', [b'Admin']), ('displayName', [b'System Admin']), ('radiusRealm', [b'domain.net']), ('radiusFramedIPAddress', [b'0.0.0.0']), ('radiusFramedIPNetmask', [b'255.255.254.0']), ('sAMAccountName', [b'admin'])]
25.01.2023 00:59:53.589 LDAP (WARNING): sync failed, saved as rejected
/var/lib/univention-connector/s4/1674598987.209238
25.01.2023 00:59:53.590 LDAP (WARNING): Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/univention/s4connector/__init__.py", line 827, in __sync_file_from_ucs
if not self.sync_from_ucs(key, mapped_object, pre_mapped_ucs_dn, old_dn, old, new):
File "/usr/lib/python3/dist-packages/univention/s4connector/s4/__init__.py", line 2128, in sync_from_ucs
self.lo_s4.lo.add_ext_s(object['dn'], addlist, serverctrls=ctrls)
File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 414, in add_ext_s
resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 749, in result3
resp_ctrl_classes=resp_ctrl_classes
File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 756, in result4
ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 329, in _ldap_call
reraise(exc_type, exc_value, exc_traceback)
File "/usr/lib/python3/dist-packages/ldap/compat.py", line 44, in reraise
raise exc_value
File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 313, in _ldap_call
result = func(*args,**kwargs)
ldap.NO_SUCH_ATTRIBUTE: {'desc': 'No such attribute', 'info': "0000200A: objectclass_attrs: attribute 'radiusFramedIPAddress' on entry 'CN=admin,CN=Users,DC=domain,DC=net' was not found in the schema!"}
How does the schema syncronization takes place between UCS LDAP and Samba AD?
Is being done automatically or do I need to manually also import the Freeradius schema into Samba so that the custom attributes to be recognized by Samba ?
What is the proper way to sync custom attributes between UCS LDAP and Samba AD ?
I could not find a clear answer in the documentation or any of the forum topics.
Thank you.