Univention Corporate Server - An open source identity management system
Univention Corporate Server is an open source identity management system, an IT infrastructure and device management solution and an extensible platform with a store-like App Center that includes tested third party applications and further UCS components: This is what Univention combines in their main product Univention Corporate Server, a Debian GNU/Linux based enterprise distribution. This article provides you the overview of Univention Corporate Server, its feature and installation.
Things to know about UCS
From all the features that distinguishes UCS, four are particularly significant:
Univention Configuration Registry
Underneath the hood you find the Univention Configuration Registry, a key value based object storage and configuration templates to control the settings of every server. Consequently, changes to a server become a matter of changing a single variable. For example, you want to tell your mail server to use a proxy server? Changing the proxy/http variable will take care of setting the correct value for the software updater, the antivirus software, possible blacklist downloads and for any user who could ssh into the server. An idea of how the Univention Configuration Registry works gives you this short video:
Domain-centric Approach
Secondly, there is the domain-centric approach to IT management. UCS itself has a role concept, which includes domain controllers and application servers and replicates users and settings throughout the domain. Thus if you have more than one mail server which needs to use the proxy, you can create a simple policy and distribute the settings to all servers. This, of course, also implies that a user only has to be provisioned once and can be enabled to use all applications within the domain from the Active Directory-compatible Domain Controller to Z-Push for Kopano, for example.
Univention App Center
Thirdly, the Univention App Center that provides even more functions via additional applications such as, for example, Kopano, ownCloud, SuiteCRM and many more. When installing them on UCS, you don't get unconfigured packages onto your hard disk, but they come with a complete configuration and integration into the management system including a transparent lifecycle management.
Web-based Management Console
The fourth and final feature is the web-based management console. It allows the administrator to control UCS, the users and most applications from the App Center via one central location. The convenient and intuitive management system, in turn, reduces the complexity of managing (new) users and the risk of unauthorized users accessing files and applications.
Where and How to get UCS
UCS is available in various “flavors”. All include the same fundamental system and the same features. However, they are preconfigured to run in different environments.
- As an ISO image for the installation in your environment
- As an AWS image
- As a virtual machine image including a growing number of images for preconfigured applications
Univention provides UCS comes in two editions: Core and Enterprise. The Core Edition is available for free. It has the same features as the Enterprise Edition but comes without support and a limited maintenance period. Help is provided via the Univention forum.
In contrast to the Core Edition, the Enterprise Edition comes with maintenance subscription and support. Univention offers a five to seven years lifecycle for the major versions of UCS. The price depends on the number of servers and the number of users in the environment. Depending on the Enterprise subscription level, the yearly prices range from $ 349 to $ 2,049.
Installation
The system uses the same basic installation with only a slight variation depending on which of the different flavors you use. For example, you will need to partition the hard disk when using the ISO image and might need an activation email for the preconfigured applications. Thus, we will focus on the more significant configuration parts that all the flavors have in common.
Configuration of the Network
After the base installation for the ISO, or the log in for all others, UCS presents you with its setup dialog. The first question is about the language and location. The language question thereby only concerns the language for the installer. The management console will later be available in English, German and, optionally, French. You can also customize your location.
Next, you will need to configure the network. One thing of note here is, if you are planning to extend your UCS domain, have UCS take over or join a Windows domain, you will need to enter an existing domain controller as the preferred DNS server, otherwise UCS will not be able to join the domain.
UCS Domain Settings
After configuring the network, you need to decide what role the UCS system should fulfill in your IT environment.
There are three primary choices:
- Create a new domain from which you can manage all users and assets
- Join an existing domain
- Join an Active Directory domain as an application server
- Do not use any domain; a choice with only limited use
System Roles
If you choose to extend your UCS domain, you will again be presented with three choices:
- Domain controller backup:
a complete replacement of the master including the LDAP and certificates - Domain controller slave:
a server with a read-only LDAP for applications that make heavy use of the LDAP such as groupware but which does not have all information needed to perform administrative functions - Member server: a lighter weight server without an LDAP that is ideal to serve as a file server or a basis for your CRM
Creation of a UCS Domain
First, select a password. On your domain controller master, the password will be used for both the local root account as well as for the LDAP management account administrator. You can later change the two passwords independently. On all other systems, the password is only for the local superuser root.
The page will optionally ask you for metadata around your organization which is later used to set some default values.
Fully Qualified Domain Name (FQDN)
Next comes the name of your server. When configuring the domain controller master, you will need to provide a fully qualified domain name (FQDN). The part up to the first dot of which will comprise your hostname, the rest your domain name. You should be aware that the element between the first and second dot will be the name Windows user will see during login. Please do NOT choose your Internet domain as it will prevent your users from reaching your external services. The installer generates the LDAP base from the domain name and you should not change it unless there is a solid reason.
Software Installation
For on-premises, you can now install additional software. In all cases, you will be able to add further software via the Univention App Center later on. Here we now forward to confirming the settings.
Done - Where To Next
After completion of the configuration assistant, the interface will welcome you to explore its many features. From here you can now start extending the features of UCS, integrating it with other systems or start adding your users into the server.
Congratulations, you now have an open, flexible, and fully functioning IT and server management solution which you can adapt and extend to your own needs.
Reference:
https://www.univention.com/products/ucs/
https://github.com/univention/