The latest patch-level release of Univention Corporate Server bundles all new features and improvements from the past months onto new installation media including a new authorization backend for Nubus Guardian, more control over password hash security, deeper Keycloak observability, and simplified Microsoft 365 classroom management for schools — alongside continued groundwork for the upcoming UCS 5.3. New with UCS 5.2-7 comes a major performance improvement for WLAN authentication at scale.
Table of Contents
Faster RADIUS Authentication for Large Environments
WLAN authentication with username and password against the Nubus RADIUS service relies internally on an authentication helper plugin. In very large environments with a high volume of authentication requests, this helper had become a measurable source of CPU load, limiting how many authentications an installation could realistically process.
With UCS 5.2-7, this helper module has been rewritten in Rust. The result is a significant reduction in CPU consumption per authentication request, which directly translates into higher throughput on the same hardware. For organizations operating large WLAN infrastructures — for example in larger school networks — this means fewer authentication bottlenecks and more headroom before additional infrastructure is needed.
Administrators do not need to change any configuration to benefit from this improvement; it is available automatically once updated. Further technical background is available in the corresponding Bugzilla entry.
New Guardian Authorization Backend Based on Cerbos
Guardian, the authorization service for Nubus, now uses the open source project Cerbos as its policy decision backend, replacing the previous OPA-based implementation. Cerbos was selected specifically because it offers features well suited to the kind of authorization decisions Guardian needs to make. Univention will publish a dedicated blog post shortly explaining the reasoning behind this decision in more detail.
Alongside the new backend, the Guardian authorization service itself has changed how it is delivered: it is now shipped as a native UCS “component,” built as a Debian package that contains a Docker container, rather than as a Docker Compose–based App Center App. Setup and upgrades of Guardian follow the UCS component lifecycle as other Nubus services like OpenLDAP or Samba, although Cerbos runs in a Docker Container. This new approach reduces the complexity needed in the App Center Docker Compose handling and installations easier to automate in software deployment tools.
More Control Over Password Hash Security
As part of the ongoing preparation for eventually removing weaker password hashes from Nubus, this release delivers several improvements that give administrators more direct control today.
The Univention Directory Manager (UDM) now offers additional configuration options to define which hashing algorithms are used when storing passwords, including the ability to remove weaker hashes that may still be present for historical compatibility reasons. Administrators can choose which hashes are needed in their services and which can be removed – our documentation provides information about which functionality is lost of weaker hashes are removed.
In addition, the Active Directory Connector has been adapted to better support environments where Active Directory is configured with reduced encryption types, covering more real-world configurations than before.
Keycloak Metrics for Prometheus and Grafana
The Keycloak App now allows administrators to activate Keycloak’s built-in Metrics Endpoint directly from the app. Once enabled, detailed information about Keycloak usage and events becomes available for collection by Prometheus and visualization in Grafana, alongside other Nubus and UCS metrics administrators may already be tracking.
This gives IT teams better visibility into authentication load, login behavior, and potential issues in their identity infrastructure — without any manual instrumentation work. Details on enabling and using the metrics endpoint are available in the Keycloak App documentation.
Education Classes Support in the Microsoft 365 Connector
Schools and educational institutions running Nubus or UCS@school alongside Microsoft 365 can now let the MS365 Connector automatically activate Microsoft 365 “education classes” for selected groups. Administrators decide which groups should be treated as education classes, and the connector takes care of enabling the feature in Microsoft 365 accordingly.
This removes a manual, error-prone administrative step from the Microsoft 365 side and ensures that educational features stay consistent with how classes and groups are already managed in the identity system. More information is available in the Microsoft 365 integration manual.
Security and Bugfixes – and Preparation for UCS 5.3
As always, this patch-level release combines the security and bugfix updates of the past months into a new installation medium. As is the case across most open source solutions, the number of reported and fixed security issues continues to rise, partly driven by the growing use of AI-assisted code review.
Additional package updates not visible as a new feature are improvements or compatibility with the upcoming UCS 5.3. This covers two scenarios in particular — domains where UCS 5.2 and UCS 5.3 systems will need to run side by side during a transitional upgrade period, and compatibility with the updated Debian base that UCS 5.3 will build on.
Download and Further Information
UCS 5.2-7 is, as always, available in the download section. Further information about the included changes can be found in the release notes and help article.
