#!/bin/sh
#
# Univention Self Service
#  join script
#
# SPDX-FileCopyrightText: 2015-2026 Univention GmbH
# SPDX-License-Identifier: AGPL-3.0-only

## joinscript api: bindpwdfile

VERSION=13

. /usr/share/univention-join/joinscripthelper.lib
. /usr/share/univention-lib/ldap.sh
. /usr/share/univention-lib/base.sh
. /usr/share/univention-lib/umc.sh

joinscript_init

ucs_addServiceToLocalhost "univention-self-service" "$@" || die

eval "$(ucr shell)"

umc_init  # Ensure "cn=UMC,cn=policies,$ldap_base" has been created
udm policies/umc create "$@" \
	--ignore_exists \
	--position="cn=UMC,cn=policies,$ldap_base" \
	--set name=selfservice-umc-servers \
	--set ldapFilter='(|(objectClass=univentionMemberserver)(objectClass=univentionDomainController))' || die
udm policies/umc modify "$@" \
	--dn "cn=selfservice-umc-servers,cn=UMC,cn=policies,$ldap_base" \
	--append "allow=cn=passwordchange-all,cn=operations,cn=UMC,cn=univention,$ldap_base" || die
udm container/cn modify "$@" \
	--dn "cn=dc,cn=computers,$ldap_base" \
	--policy-reference "cn=selfservice-umc-servers,cn=UMC,cn=policies,$ldap_base" || die
udm container/cn modify "$@" \
	--dn "cn=memberserver,cn=computers,$ldap_base" \
	--policy-reference "cn=selfservice-umc-servers,cn=UMC,cn=policies,$ldap_base" || die

stop_udm_cli_server

MASTER=$(ucr get ldap/master)
univention-config-registry set \
	"self-service/backend-server?$MASTER" \
	self-service/web/enabled?yes

joinscript_save_current_version

exit 0
