How-to: UCS@school: Enable the Users Module for School Administrators on a School-Replica Node

Knowledge Base Community
, , , ,
1

Howto

By default, the Users module in School Administration is not available to school administrators on a Replica Node (School-Server).

To make the Users module available to school administrators on a Replica Node, install the required package and add the schoolwizards-users operation set to the UMC policy used by school administrators:

ucsschool-umc-admins-default

Important: The required operation set is schoolwizards-users. Do not use schoolusers-* or udm/users/user.

Investigation

UMC policies are stored in LDAP. Therefore, a policy assignment generally also applies on a Replica Node after LDAP replication.

However, the Replica Node must additionally meet the following requirements:

  1. The ucs-school-umc-wizards package is installed.

  2. The school administrator still has the appropriate ucsschoolRole on the Replica Node, for example:

    school_admin:school:<SCHULNAME>

  3. The UMC policy is evaluated on the Replica Node.

  4. The UMC server is restarted after the configuration change, or the existing UMC session is recreated:

    systemctl restart univention-management-console-server

  5. The user signs in again completely. An already open UMC browser tab can cache the previous module list.

Important

The existing availability tests for school administrators on a domaincontroller_slave do not expect schoolwizards/users to be available by default.

Therefore, enabling this module for school administrators on Replica Nodes is not part of the default configuration and must be configured explicitly.

The LDAP ACLs in 65ucsschool generally allow school administrators to access user objects belonging to their own school. Therefore, if the module is missing on the Replica Node, the most likely cause is not an LDAP ACL issue but the UMC policy or module authorization on the Replica Node.

Step 1: Install the Required Package on the Replica Node

Install the missing ucs-school-umc-wizards package on the Replica Node (School-Server):

univention-install ucs-school-umc-wizards

Check the package status:

dpkg -l ucs-school-umc-wizards
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                   Version      Architecture Description
+++-======================-============-============-=================================
ii  ucs-school-umc-wizards 13.1.1       all          UCS@school UMC wizard modules

The ii status confirms that the package is installed.

Step 2: Add the UMC Operation to the School Administrator Policy

The schoolwizards-users UMC operation must be added to the school administrator policy so that school administrators can use the Users module in School Administration.

Policy Before the Change

List the currently assigned UMC operations:

udm policies/umc list --filter cn=ucsschool-umc-admins-default
cn=ucsschool-umc-admins-default
DN: cn=ucsschool-umc-admins-default,cn=UMC,cn=policies,dc=deadpool,dc=intranet
  allow: cn=schoollists-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolgroups-workgroup-admin,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolgroups-class,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolgroups-teacher,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolusers-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolrooms-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolexam-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=computerroom-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=distribution-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=helpdesk-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=internetrules-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=lessontimes-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=printermoderation-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  createTimestamp: 2026-06-11 15:12:08
  creatorsName: cn=admin,dc=deadpool,dc=intranet
  entryCSN: 20260821085011.281874Z#000000#000#000000
  entryUUID: a885991e-f9f3-1040-86dc-2fd80c9e5af5
  ldapFilter: None
  modifiersName: uid=Administrator,cn=users,dc=deadpool,dc=intranet
  modifyTimestamp: 2026-08-21 08:50:11
  name: ucsschool-umc-admins-default
  univentionObjectIdentifier: 22985a99-2cd4-4500-9e53-e1b0856fa166

The output does not contain the following operation:

cn=schoolwizards-users,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet

Step 3: Add the UMC Operation to the School Administrator Policy

Add schoolwizards-users to the policy:

udm policies/umc modify --dn cn=ucsschool-umc-admins-default,cn=UMC,cn=policies,dc=deadpool,dc=intranet --append allow="cn=schoolwizards-users,cn=operations,cn=UMC,cn=univention,$(ucr get ldap/base)"

Object modified: cn=ucsschool-umc-admins-default,cn=UMC,cn=policies,dc=deadpool,dc=intranet

Verify the Configuration

List all UMC operations assigned to the policy:

udm policies/umc list --filter cn=ucsschool-umc-admins-default
cn=ucsschool-umc-admins-default
DN: cn=ucsschool-umc-admins-default,cn=UMC,cn=policies,dc=deadpool,dc=intranet
  allow: cn=schoollists-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolgroups-workgroup-admin,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolgroups-class,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolgroups-teacher,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolusers-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolrooms-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolexam-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=computerroom-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=distribution-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=helpdesk-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=internetrules-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=lessontimes-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=printermoderation-all,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  allow: cn=schoolwizards-users,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet
  createTimestamp: 2026-06-11 15:12:08
  creatorsName: cn=admin,dc=deadpool,dc=intranet
  entryCSN: 20260821085011.281874Z#000000#000#000000
  entryUUID: a885991e-f9f3-1040-86dc-2fd80c9e5af5
  ldapFilter: None
  modifiersName: uid=Administrator,cn=users,dc=deadpool,dc=intranet
  modifyTimestamp: 2026-08-21 08:50:11
  name: ucsschool-umc-admins-default
  univentionObjectIdentifier: 22985a99-2cd4-4500-9e53-e1b0856fa166

Verify that the following entry is now present:

allow: cn=schoolwizards-users,cn=operations,cn=UMC,cn=univention,dc=deadpool,dc=intranet

Step 4. Sign In Again

Completely sign out of UMC and sign in again as the school administrator.

Do not rely on an already open UMC browser tab because it can retain the previous module list.

After signing in again, the Users tile in School Administration should be available through:

schoolwizards/users

Rollback (Additional)

To revert the changes, remove the schoolwizards-users operation from the UMC policy and uninstall the package.

Remove the UMC Operation from the Policy

udm policies/umc modify --dn "cn=ucsschool-umc-admins-default,cn=UMC,cn=policies,dc=deadpool,dc=intranet" --remove allow="cn=schoolwizards-users,cn=operations,cn=UMC,cn=univention,$(ucr get ldap/base)"

Remove the Package

univention-remove ucs-school-umc-wizards

Troubleshooting

If the Users module is still unavailable after applying the configuration, verify the following:

  • ucs-school-umc-wizards is installed on the Replica Node.

  • The schoolwizards-users operation set exists.

  • schoolwizards-users is assigned to ucsschool-umc-admins-default.

  • The school administrator has the appropriate ucsschoolRole, for example:

    school_admin:school:<SCHULNAME>

  • The relevant LDAP changes have been replicated to the Replica Node.

  • The UMC policy is actually evaluated for the school administrator on the Replica Node.

  • univention-management-console-server has been restarted.

  • The school administrator has completely signed out and signed in again.

If LDAP access to the school’s user objects works but the Users tile remains unavailable, focus troubleshooting on the UMC policy and module authorization rather than the LDAP ACLs.

See also: