Problem: Check failed 904 ucsschool remove from school consistenceny

Problem:

Check failed: 904_ucsschool_remove_from_school_consistenceny - UCS@school Group Consistency

Investigation:

The output may look like this:

The following problems were found:
cn=sun-10d,cn=klassen,cn=schueler,cn=groups,ou=sun,dc=schein,dc=me
   - uid=sarah.conn,cn=schueler,cn=users,ou=sun,dc=schein,dc=me has no ucsschoolRole, but is in group

Now you should first check, if the user already has its ucsschoolRole:

univention-ldapsearch -LLL uid=sarah.conn univentionObjectType ucsschoolRole
dn: uid=sarah.conn,cn=schueler,cn=users,ou=sun,dc=schein,dc=me
univentionObjectType: users/user
ucsschoolRole: student:school:sun

and if the group already has the ucsschoolRole

univention-ldapsearch -LLL cn=sun-10d ucsschoolRole
# sun-10d, klassen, schueler, groups, sun, schein.me
dn: cn=sun-10d,cn=klassen,cn=schueler,cn=groups,ou=sun,dc=schein,dc=me
ucsschoolRole: school_class:school:sun

# sun-10d, klassen, shares, sun, schein.me
dn: cn=sun-10d,cn=klassen,cn=shares,ou=sun,dc=schein,dc=me
ucsschoolRole: school_class_share:school:sun

If this looks okay, you can check like the diagnostic tool:

univention-ldapsearch '(ucsschoolRole=*)' dn | grep sarah.conn

In this case we do not get a search result! But with the next one

univention-ldapsearch '(ucsschoolRole=s*)' dn | grep sarah.conn
# sarah.conn, schueler, users, sun, schein.me
dn: uid=sarah.conne,cn=schueler,cn=users,ou=sun,dc=schein,dc=me

It looks like the attributes on the user objects are not in the index of the ldap, so the check does not find these users in the right groups even though everything is correct.

Solution:

You can now have the indexes created again. This can take a little longer in larger environments.

ucr set ldap/database/mdb/envflags=nosync
systemctl restart slapd

Then the value is accepted.
Now turn off the ldap for safety.

systemctl stop slapd

Gladly check that the process is gone.
ps aufx |grep slapd
Then
slapindex

Like I said, this may take some time. Then

ucr unset ldap/database/mdb/envflags
systemctl start slapd

Bonus

You can run the check on the console manually as root:

python /usr/share/pyshared/univention/management/console/modules/diagnostic/plugins/904_ucsschool_remove_from_school_consistenc
eny.py
Mastodon