Source: http://docs.software-univention.de/release-notes-4.3-3-de.html
Timestamp: 2019-01-22 18:55:05+00:00

Document:
Release Notes für die Inbetriebnahme und Aktualisierung von Univention Corporate Server (UCS) 4.3-3
6.3.1.1. Changes to templates and modules
6.5.7. Domain join module
6.5.8. System diagnostic module
6.5.9. Policies
6.5.10. Filesystem quota module
6.5.11. Other modules
6.7. Software deployment
6.8.1. PostgreSQL
6.8.2. Docker
6.8.3. SAML
6.8.4. Univention self service
6.8.5. Mail services
6.8.6. Dovecot
6.8.7. Printing services
6.8.8. Nagios
6.8.9. RADIUS
6.8.10. Proxy services
6.8.11. SSL
Mit Univention Corporate Server 4.3-3 steht das dritte Point-Release für Univention Corporate Server (UCS) 4.3 zur Verfügung. Es umfasst Funktionserweiterungen und Verbesserungen, neue Eigenschaften sowie diverse Detailverbesserungen und Fehlerkorrekturen. Die wichtigsten Änderungen im Überblick:
Die Konfigurationsmöglichkeiten für das UCS Portal wurden erweitert, um es besser an eigene Bedürfnisse anzupassen. Es können jetzt eigene Kategorien für Kacheln definiert werden. Zudem gibt es die Möglichkeit, statische Links zu definieren, um beispielweise ein Impressum zu verlinken.
Die neue UCS Dashboard App ermöglicht Administratoren den Zustand der Domäne oder einzelner Server schnell und einfach auf unterschiedlichen Dashboards abzulesen.
Neben kleineren Fehlerbehebungen in Univention Management Console wurde insbesondere das Scrolling an vielen Stellen verbessert.
Die Einführung einer neuen vereinfachten Python API verringert für Entwickler den Entwicklungsaufwand um auf das UCS Identity Management zuzugreifen.
Diverse Security Updates wurden in UCS 4.3-3 integriert, bspw. für den Linux Kernel, Samba und Apache2. UCS 4.3-3 basiert auf dem im November veröffentlichten Debian Release 9.6. Eine vollständige Liste ist in Kapitel 6 zu finden.
Die Changelogs mit den detaillierten Änderungsinformationen werden nur in Englisch gepflegt. Aufgeführt sind die Änderungen seit UCS 4.3-2:
All security updates issued for UCS 4.3-3 are included:
apache2 (CVE-2018-1333 CVE-2018-11763) (Bug 48163)
asterisk (CVE-2018-7284 CVE-2018-7286 CVE-2018-12227 CVE-2018-17281) (Bug 48007)
ceph (CVE-2017-7519 CVE-2018-1128 CVE-2018-1129 CVE-2018-10861) (Bug 48179)
clamav (CVE-2018-15378) (Bug 48052)
curl (CVE-2018-14618 CVE-2018-16839 CVE-2018-16842) (Bug 47759 Bug 48093)
firefox-esr (CVE-2017-16541 CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12379 CVE-2018-12383 CVE-2018-12385 CVE-2018-12386 CVE-2018-12387 CVE-2018-12389 CVE-2018-12390 CVE-2018-12392 CVE-2018-12393 CVE-2018-12395 CVE-2018-12396 CVE-2018-12397) (Bug 47775 Bug 47851 Bug 47904 Bug 48049)
firmware-nonfree (CVE-2016-0801 CVE-2017-0561 CVE-2017-9417 CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081) (Bug 48178)
ghostscript (CVE-2017-7948 CVE-2017-8908 CVE-2017-9610 CVE-2017-9618 CVE-2017-9619 CVE-2017-9620 CVE-2017-9740 CVE-2018-11645 CVE-2018-15908 CVE-2018-15910 CVE-2018-15911 CVE-2018-16509 CVE-2018-16511 CVE-2018-16513 CVE-2018-16539 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 CVE-2018-16543 CVE-2018-16585 CVE-2018-16802 CVE-2018-17183 CVE-2018-17961 CVE-2018-18073 CVE-2018-18284 CVE-2018-19409 CVE-2018-19475 CVE-2018-19476 CVE-2018-19477) (Bug 47774 Bug 47825 Bug 48170 Bug 48238)
git (CVE-2018-17456) (Bug 47989)
gnutls28 (CVE-2018-10844 CVE-2018-10845 CVE-2018-10846) (Bug 48174)
hylafax (CVE-2018-17141) (Bug 47849)
imagemagick (CVE-2018-16412 CVE-2018-16413 CVE-2018-16642 CVE-2018-16644 CVE-2018-16645) (Bug 47990)
lcms2 (CVE-2018-16435) (Bug 47760)
libarchive-zip-perl (CVE-2018-10860) (Bug 47853)
libgd2 (CVE-2018-5711 CVE-2018-1000222) (Bug 48175)
liblivemedia (CVE-2018-4013) (Bug 48202)
libmspack (CVE-2017-6419 CVE-2017-11423 CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682 CVE-2018-18584 CVE-2018-18585) (Bug 48168)
libopenmpt (CVE-2018-10017) (Bug 48177)
libssh (CVE-2018-10933) (Bug 48012)
libtirpc (CVE-2018-14622) (Bug 48171)
libx11 (CVE-2018-14598 CVE-2018-14599 CVE-2018-14600) (Bug 48180)
libxcursor (CVE-2015-9262) (Bug 48176)
linux (CVE-2017-18216 CVE-2017-18224 CVE-2018-3620 CVE-2018-6554 CVE-2018-6555 CVE-2018-7755 CVE-2018-9363 CVE-2018-9516 CVE-2018-10876 CVE-2018-10877 CVE-2018-10881 CVE-2018-10882 CVE-2018-10883 CVE-2018-10902 CVE-2018-10938 CVE-2018-13099 CVE-2018-13405 CVE-2018-13406 CVE-2018-14609 CVE-2018-14617 CVE-2018-14633 CVE-2018-14678 CVE-2018-14734 CVE-2018-15471 CVE-2018-15572 CVE-2018-15594 CVE-2018-16276 CVE-2018-16658 CVE-2018-17182 CVE-2018-18021) (Bug 47894 Bug 47987 Bug 48172)
mariadb-10.1 (CVE-2017-10268 CVE-2017-10378 CVE-2017-15365 CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 CVE-2018-2755 CVE-2018-2761 CVE-2018-2766 CVE-2018-2767 CVE-2018-2771 CVE-2018-2781 CVE-2018-2782 CVE-2018-2784 CVE-2018-2787 CVE-2018-2813 CVE-2018-2817 CVE-2018-2819 CVE-2018-3058 CVE-2018-3063 CVE-2018-3064 CVE-2018-3066 CVE-2018-3081 CVE-2018-3143 CVE-2018-3156 CVE-2018-3174 CVE-2018-3251 CVE-2018-3282) (Bug 48201)
net-snmp (CVE-2018-18065) (Bug 47991)
network-manager (CVE-2018-15688) (Bug 48164)
okular (CVE-2018-1000801) (Bug 47852)
openjdk-8 (CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3183 CVE-2018-3214) (Bug 48074)
openssl (CVE-2018-0732 CVE-2018-0734 CVE-2018-0735 CVE-2018-0737)
perl (CVE-2018-18311 CVE-2018-18312 CVE-2018-18313 CVE-2018-18314) (Bug 48239)
python2.7 (CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 CVE-2018-1000802) (Bug 47890)
python3.5 (CVE-2017-1000158 CVE-2018-1060 CVE-2018-1061 CVE-2018-14647) (Bug 47891)
qemu (CVE-2018-10839 CVE-2018-17962 CVE-2018-17963) (Bug 48165)
ruby2.3 (CVE-2018-16395 CVE-2018-16396) (Bug 48094)
samba (CVE-2018-16851) (Bug 47583 Bug 48183)
spamassassin (CVE-2017-15705 CVE-2018-11780 CVE-2018-11781) (Bug 48169)
spice (CVE-2018-10873) (Bug 47996)
systemd (CVE-2018-15688) (Bug 48162)
texlive-bin (CVE-2018-17407) (Bug 47892)
tiff (CVE-2018-5784 CVE-2018-7456 CVE-2018-8905 CVE-2018-10963 CVE-2018-17101 CVE-2018-18557 CVE-2017-11613 CVE-2017-17095)
unbound (CVE-2017-15105) (Bug 48173)
univention-kernel-image-signed (CVE-2017-18216 CVE-2017-18224 CVE-2018-3620 CVE-2018-6554 CVE-2018-6555 CVE-2018-7755 CVE-2018-9363 CVE-2018-9516 CVE-2018-10876 CVE-2018-10877 CVE-2018-10881 CVE-2018-10882 CVE-2018-10883 CVE-2018-10902 CVE-2018-10938 CVE-2018-13099 CVE-2018-13405 CVE-2018-13406 CVE-2018-14609 CVE-2018-14617 CVE-2018-14633 CVE-2018-14678 CVE-2018-14734 CVE-2018-15471 CVE-2018-15572 CVE-2018-15594 CVE-2018-16276 CVE-2018-16658 CVE-2018-17182 CVE-2018-18021) (Bug 47894 Bug 47987 Bug 48172)
wireshark (CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354 CVE-2017-9616 CVE-2017-9617 CVE-2017-9766 CVE-2017-11406 CVE-2017-11407 CVE-2017-11410 CVE-2017-13764 CVE-2017-13765 CVE-2017-13767 CVE-2017-15189 CVE-2017-15191 CVE-2017-15192 CVE-2017-15193 CVE-2017-17935 CVE-2017-17997 CVE-2018-7321 CVE-2018-7322 CVE-2018-7323 CVE-2018-7324 CVE-2018-7325 CVE-2018-7326 CVE-2018-7329 CVE-2018-7331 CVE-2018-7332 CVE-2018-7333 CVE-2018-7336 CVE-2018-7337 CVE-2018-7417 CVE-2018-7418 CVE-2018-7420 CVE-2018-7421 CVE-2018-9256 CVE-2018-9257 CVE-2018-9258 CVE-2018-9259 CVE-2018-9260 CVE-2018-9262 CVE-2018-9263 CVE-2018-9265 CVE-2018-9266 CVE-2018-9267 CVE-2018-9268 CVE-2018-9269 CVE-2018-9270 CVE-2018-9271 CVE-2018-9272 CVE-2018-11356 CVE-2018-11357 CVE-2018-11359 CVE-2018-11361 CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14368 CVE-2018-14369 CVE-2018-16056 CVE-2018-16057 CVE-2018-16058) (Bug 47992)
wpa (CVE-2018-14526) (Bug 48167)
xorg-server (CVE-2018-14665) (Bug 48073)
The following updated packages from Debian 9.6 are included (Bug 48278): accerciser, base-files, brltty, canna, cargo, chromium-browser, confuse, debian-installer, debian-installer-netboot-images, discount, dnsmasq, dom4j, dpdk, dropbear, drupal7, easytag, enigmail, espeakup, fastforward, firetray, fuse, ganeti, globus-gsi-credential, gnupg2, gphoto2-cffi, graphicsmagick, grub2, hdparm, https-everywhere, i3-wm, icecast2, iipimage, jhead, kamailio, lastpass-cli, ldap2zone, libcgroup, libclamunrar, libdap, libdatetime-timezone-perl, libextractor, libmail-deliverystatus-bounceparser-perl, libseccomp, libxml-stream-perl, libxml-structured-perl, lxcfs, mailman, mbedtls, mediawiki, mgetty, moin, mosquitto, multipath-tools, mupdf, nagstamon, network-manager-applet, nginx, ola, openafs, opensc, otrs2, pkgsel, publicsuffix, python-django, python-imaplib2, roundcube, ruby-json-jwt, rustc, sddm, serf, soundconverter, spice-gtk, sqlcipher, strongswan, subversion, sympa, systraq, thunderbird, tinc, tomcat-native, tor, trafficserver, tzdata, ublock-origin, vagrant, vmtk, x11vnc, xapian-core, xmotd, xorg-server, zutils
The following packages have been moved to the maintained repository of UCS: backports.ssl-match-hostname (Bug 43612), cached-property (Bug 43612), docker-compose (Bug 43612), dockerpty (Bug 43612), docopt (Bug 43612), lazy-object-proxy (Bug 48086), libconfig-inifiles-perl (Bug 48201), libhx (Bug 47933), libresample (Bug 48007), python-bsddb3 (Bug 47933), python-docker (Bug 43612), python-functools32 (Bug 43612), python-jsonschema (Bug 43612), python-ruamel.ordereddict (Bug 43612), python-typing (Bug 43612), ruamel.yaml (Bug 43612), texttable (Bug 43612), websocket-client (Bug 43612), wimlib (Bug 47994)
The UCS DVD now contains the package netcat-openbsd. It is required for VNC access to virtual machines (Bug 48015).
If UCS is installed from an USB stick, grub-install shows a screen to select the boot device. That list no longer includes the USB stick itself (Bug 47925).
Univention Configuration Registry modules cannot accidentally get registered multiple times anymore (Bug 35239).
§6.3.1.1. Changes to templates and modules
Ensure that the address associated with the network interface specified via the Univention Configuration Registry variable interfaces/primary is the first entry in /etc/hosts (Bug 30397).
Ensure that the directory /var/univention-backup/ exists in univention-config-registry-backup (Bug 47336).
The Univention Directory Listener opens two connections: a persistent connection to a Univention Directory Notifier and an on-demand connection to an LDAP server. In some rare situations two different hosts were contacted for those connections, which could lead to inconsistencies in LDAP replication (Bug 48030).
Fix terminal detection code in univention-directory-listener-ctrl (Bug 47870).
Log a message when a listener module using the new API was deactivated (Bug 47871).
Fixed a crash when the Univention Configuration Registry variables server/role and ldap/master are not set (Bug 47837).
An alternative mechanism to initialize the Univention Directory Listener in large environments was added (Bug 47783).
A widget for limited text input has been moved to the common library (Bug 48106).
Long item names in the tree widget no longer overlap underlying items (Bug 45323).
The version of the dojo framework has been upgraded (Bug 47997).
The scrolling in the UCS Virtual Machine Manager module has been improved (Bug 36624).
The scrolling in the LDAP directory module has been improved (Bug 45598).
It is now possible to define custom categories for the portal (Bug 47243).
An issue with the drop-down menu for the search value in the advanced search of UDM modules being unusable has been resolved (Bug 44471).
The ordering of the default categories in the Portal unintentionally changed with a previous update. This has been reverted (Bug 47872).
Fix the broken text of the portal title and name (Bug 47877).
Portal entries not shown after update to latest portal version (Bug 47870).
Portal entries were not shown after the update to erratum 250 (Bug 47864).
The visibility of a portal entry object can now be restricted to multiple groups instead of just one (Bug 46927).
Allow to customize portal with static pages (Bug 43442).
Fix SAML metadata creation for external certificate authorities like Let's Encrypt (Bug 47700).
Fix regression in traceback handling (Bug 47857).
Improved check for database existence when installing an app which uses a database (Bug 42690).
Checkboxes in the App Settings were marked as required in the HTML causing problems when submitting the form (Bug 47824).
The App Center now supports Apps that require multiple containers to work by using docker-compose (Bug 43612).
In some cases the App Center removed installed listener modules (Bug 48104).
Never prompt in container commands during the app installation (Bug 47763).
Installation routines now ask for valid credentials before actually doing anything. Prior to this change, the user may have been prompted for credentials in the middle of the installation process. Invalid credentials at this point may have led to errors (Bug 47619).
Proxy settings in containers are updated before an app upgrade (Bug 47439).
When an app is opened in the App Center, the page now scrolls to the top and when the App detail page is closed, the previous scroll position is restored (Bug 39667).
System accounts are not counted if the license allows unlimited users (Bug 48145).
Keep the choices for the modules in extended attributes updated (Bug 30387).
Added a new hook base class AttributeHook. This can be used to implement a mapping between LDAP and UDM for extended attributes (Bug 43129).
The username admin is now allowed (Bug 38092).
The UDM module settings/data was added. It can be used to store arbitrary data in LDAP (Bug 47944).
A new API has been added that aims to provide a much easier handles for UDM calls (Bug 47316).
Ensure update of syntax class mailinglist_name in running Python processes (Bug 48020).
Revert reloading syntax.py (Bug 48026).
Searching for some UDM properties led to a traceback (Bug 47910).
Some error messages are more explicit (Bug 47861).
Fix a traceback during portal assignment at computer objects when a settings/portal object is created (Bug 47818).
The search filter generated for boolean and multi-value properties of UDM objects was not correct (Bug 40672).
For performance reasons, UDM stores the last used value of uidNumber and gidNumber in an LDAP object in the univentionLastUsedValue attribute. Usually these two values are monotonously increasing with automatic assignment. When manually specifying the uidNumber/gidNumber when creating an object, however, this value could jump back to a lower value and previously used and now free values could be reused if necessary. This behavior has now been disabled. univentionLastUsedValue is now monotonously increasing (Bug 41109).
User Templates now have access to the alphanum option (Bug 47580).
Allow to customize portal with an about page (Bug 43442).
The error messages for the join into an Active Directory domain have been improved (Bug 42430).
A regression introduced while fixing Bug 42022 could cause an appliance setup to fail due to missing software components (Bug 47767).
When setting up an UCS appliance to join into an existing UCS domain, the installation could fail due to a failure to reconfigure the network interfaces (Bug 47767).
Adapt Univention System Setup to work with Firefox 60 (Bug 47808).
Only try to download the host certificate for 10 minutes when joining a new system. Otherwise, mark the join as failed (Bug 30005).
Fixed join failing when two MAC addresses are set on the computer object. Also, joining a host with multiple network interfaces now attaches them all to the computer object (Bug 47338).
§6.5.8. System diagnostic module
The ACL check for the Samba/AD SYSVOL files has been improved to show the name of missing files and directories (Bug 47583).
A new diagnostic plugin has been added that scans through LDAP and finds objects that lack a univentionObjectType although they should have one. The plugin also allows to migrate those objects. Having a univentionObjectType allows for other services to use a convenient LDAP filter (Bug 47844).
Improved logging of diagnostic module actions and the diagnostic checks are now executed in lexical order (Bug 47649).
§6.5.9. Policies
Log LDAP connections at log level PROCESS instead of INFO (Bug 48030).
§6.5.10. Filesystem quota module
Setting a user quota through a policy now works with journaled (usrjquota) quota as well (Bug 47764).
The Univention Directory Manager module flavors are requiring a minimal set of allowed UMC commands now to be visible in the UMC (Bug 47880).
A regression in the users/self module regarding saving unset properties with default values has been addressed (Bug 48047).
The page now scrolls to the top when opening the detail page of an UDM object (Bug 39667).
The function umc_init does not assume to find the LDAP group objects cn=Domain Admins and cn=Domain Users as direct children of the cn=groups container anymore. Instead it searches for them (or their localized equivalents, like Domänen-Admins) (Bug 38057).
Check output from slapschema during registration of new schemas for errors (Bug 45571).
False warning message during App installation were removed (Bug 47931).
LDAP ACLs for the portal category module have been fixed (Bug 48091).
A spelling error in the English description for Univention Configuration Registry variable ldap/debug/level has been fixed (Bug 48102).
Fix automatic renewal of Diffie-Hellman parameters for forward secrecy (Bug 47974).
Adjust description of Univention Configuration Registry variable ldap/database/mdb/envflags (Bug 47869).
§6.7. Software deployment
In case a Debian package update fails due to unmet dependencies univention-updater now logs a more useful error message (Bug 34444).
§6.8.1. PostgreSQL
The rule for the PostgreSQL superuser has been moved to the beginning of pg_hba.conf to always grant access to that internal user. This is required for automatic maintenance and similar tasks (Bug 31081).
The new Univention Configuration Registry variable postgres9/pg_hba/config/* allows for additional configuration options in the file pg_hba.conf (Bug 47276).
§6.8.2. Docker
ifconfig was missing in the UCS container. Also fixed parsing of the tool's output (Bug 46665).
§6.8.3. SAML
Enable stunnel to run on systems without univention-saml installed, like member server and slave domain controller servers. The univention-saml package was updated to create the required directories (Bug 47250).
§6.8.4. Univention self service
The join script now always updates the local database password (Bug 45531).
§6.8.5. Mail services
Remove ClamAV from AMaViS configuration if clamav-daemon is disabled via Univention Configuration Registry variable clamav/daemon/autostart=no. Without this change Postfix is unable to process incoming mails due to a non-working AMaViS (Bug 39372).
§6.8.6. Dovecot
When creating users, an SSL error occurred when uploading the initial Sieve script if the Dovecot server used an external SSL certificate from Let's Encrypt, for example. The new Univention Configuration Registry variable mail/dovecot/sieve/client/server can now be used to specify an external FQDN for the Sieve script upload that matches the external SSL certificate (Bug 41018).
§6.8.7. Printing services
Fix a traceback when querying for printer users (Bug 44434).
The printer restrictions are reloaded after changes are made (Bug 43227).
§6.8.8. Nagios
The Nagios RAID check now uses the plugin mdstat (Bug 47319).
§6.8.9. RADIUS
From now on univention-radius adds a section realm in proxy.conf to allow RADIUS authentication with DOMAIN\USERNAME. The original proxy.conf is diverted to proxy.conf.debian and is included into the new proxy.conf (Bug 42535).
A user's description attribute is now no longer modified if the module ldap has been activated manually (Bug 48105).
§6.8.10. Proxy services
Squid is now compiled with support for OpenSSL again. This feature was lost during the update to UCS 4.3-0 because Squid 3.5 requires an additional compile time option for this (Bug 47809).
§6.8.11. SSL
The cron job to revoke expired certificates now works properly again (Bug 47896).
SSL host certificates are now also valid for DNS alias records (Bug 44469).
The command univention-certificate renew does not revoke the old certificates anymore, so that they are still valid until they expire. Additionally, certificates can now get addressed by their serial numbers using the option -id (Bug 41013).
Show a warning if the entered VNC password for a virtual machine exceeds a certain length (Bug 48106).
Report IO errors in UMC frontend (Bug 22695).
Drop corrupt cache files on errors (Bug 35761).
Fix assignment of target device name for newly added disks (Bug 47956).
Migration of virtual machines between incompatible CPUs can be prevented by setting the new Univention Configuration Registry variable uvmm/vm/cpu/host-model to either missing or always: This modifies the XML description to include a description for the CPU of the host system for running virtual machines. If a CPU description is present, UVMM will check the target host for compatibility. The migration is aborted if the target host's CPU is not compatible. Virtual machines must be restarted to activate pending changes. UVMM monitors running virtual machines for reboot events and restarts them automatically (Bug 21386).
Always set map acl inherit = yes for samba shares if NT ACLs and inherit ACLs are activated (Bug 47850).
Ignore netlogon_creds_cli.tdb in univention-samba4-backup (Bug 46468).
Changing the primary group of a user triggered an inconsistency in the DN SID component of the member attribute. In special situations samba-tool dbcheck was unable to fix this automatically (Bug 48054).
Continue samba-tool dbcheck --fix even if a modification failed (Bug 48040).
When joining a new Samba/AD DC, Samba replicates all LDAP partitions independently. Depending on timing the replication of the linked attribute serverReference could fail, if CN=Configuration gets replicated before the main domain partition. As a result DRS replication could fail (Bug 47441).
When performing an AD-Takeover out of an ad/member setup, the S4-Connector reported tracebacks due to missing NT password hashes in OpenLDAP (Bug 35540).
Fix sync_to_ucs reject for DNS Start of Authority (SOA) records with trailing dot missing in the Name Server (NS) resource record (Bug 44104).
An indentation bug in the mapping file of the S4-Connector has been fixed which triggered an error in cases where Univention Configuration Registry variable connector/s4/mapping/dns/ignorelist was unset or empty (Bug 44711).
The group membership sync now correctly identifies ucs_module_others if defined in the mapping (Bug 47779).
Renaming a container (only difference in upper and lower case) has been fixed (Bug 47374).
When password change on next login had been activated for a user the S4-Connector removed shadowMax and krb5PasswordEnd and reset shadowLastChange to 0 when synchronizing changes back from Samba/AD to UDM/OpenLDAP. In an UCS@school specific UMC module this caused a display issue, where the next required password change was shown as never (Bug 47508, Bug 47595).
The S4-Connector no longer updates the obsolete attribute sambaPwdMustChange (Bug 45282).
The Connector now updates the AD attribute userPrincipalName if the UCS username is changed. This is enabled only for new installations. For old systems unset Univention Configuration Registry variable connector/ad/mapping/sync/userPrincipalName and restart the AD-Connector to sync username to userPrincipalName on subsequent object modifications (Bug 48153).
univention-adsearch now accepts space separated attribute list as parameter (Bug 43189).
Non-printable attributes in univention-adsearch are printed base64 encoded (Bug 48082).
The special cn=Subschema object caused AD-Connector rejects (Bug 47396).
The synchronization of the attribute proxyAddress may fail if is empty (Bug 46751).
Fix AD to UCS password hash synchronization in cases where a custom Domain Admin account is configured for the AD connection (Bug 47069).
Fix Kerberos authentication error during AD-Connector restart in AD/member mode in case of changed system time (Bug 48227).
The synchronization of password hashes from AD to UCS has been fixed on systems that have Univention Configuration Registry variable connector/ldap/server set to a non-master server with read-only OpenLDAP (Bug 44024).
The package univention-ad-connector-exchange did reset specific Univention Configuration Registry variable values to their default during the update. This has been adjusted to keep customer adjusted values untouched (Bug 47856).
The tool univention-adsearch now also uses the file containing the full certificate chain instead of only the exported AD certificate alone (Bug 47858).
Support SASL/GSSAPI in AD Connection setup scripts (to support integrity checking during binds) (Bug 47901).
A traceback during the add of users in AD with telephone attributes has been fixed (Bug 47209).
Adapt to changes in univention-directory-manager-modules (Bug 47861).
The machine account password is changed by default every 21 days. That check is by default performed nightly a 01:00 by a cron job. That point of time can now be configured through the new Univention Configuration Registry variable server/password/cron (Bug 47781).

References: §6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6

§6