Problem
A created computer room is visible in School administration → Room management but not available in Education → Computer room.
Solution
- Make sure the ucsschoolRole attributes are present
univention-ldapsearch -LLL cn='<schoolname>-<roomname>' | grep ucsschoolRole
- We missed the attribute
ucsschoolRole: veyon-backend:school:-
- Add the missing attribute
ldapmodify -x -D "cn=admin,$(ucr get ldap/base)" -y /etc/ldap.secret <<EOR
dn: cn=<schoolname>-<roomname>,cn=raeume,cn=groups,ou=<schoolname>,$(ucr get ldap/base)
changetype: modify
add: ucsschoolRole
ucsschoolRole: veyon-backend:school:-
EOR
Other Case
In some cases the issue can occur even if the attribute ucsschoolRole: veyon-backend:school:- is already present on the computer room object.
root@srv-ucsr01:~# univention-ldapsearch cn=<schoolname>-testraum01
# <schoolname>-testraum01, raeume, groups, <schoolname>, schule-univention.de
dn: cn=<schoolname>-testraum01,cn=raeume,cn=groups,ou=<schoolname>,dc=schule-univention,dc=de
cn: <schoolname>-testraum01
gidNumber: 9590
sambaGroupType: 2
univentionGroupType: -2147483646
univentionMicrosoft365GroupType: Security Group
ucsschoolRole: computer_room:school:<schoolname>
ucsschoolRole: veyon-backend:school:-
sambaSID: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXXX
objectClass: posixGroup
objectClass: sambaGroupMapping
objectClass: univentionOffice365
objectClass: univentionObject
objectClass: top
objectClass: univentionGroup
objectClass: ucsschoolGroup
univentionObjectType: groups/group
uniqueMember: cn=cl<schoolname>-ws01,cn=computers,ou=<schoolname>,dc=schule-univention,dc=de
uniqueMember: cn=cl<schoolname>-ws02,cn=computers,ou=<schoolname>,dc=schule-univention,dc=de
memberUid: cl<schoolname>-ws01$
memberUid: cl<schoolname>-ws02$
In this case, removing and re-adding the veyon-backend:school:- attribute resolves the issue and makes the computer room visible again.
Step 1 – Delete the attribute:
ldapmodify -x -D "cn=admin,$(ucr get ldap/base)" -y /etc/ldap.secret <<EOR
dn: cn=<schoolname>-<roomname>,cn=raeume,cn=groups,ou=<schoolname>,$(ucr get ldap/base)
changetype: modify
delete: ucsschoolRole
ucsschoolRole: veyon-backend:school:-
EOR
Step 2 – Re-add the attribute:
ldapmodify -x -D "cn=admin,$(ucr get ldap/base)" -y /etc/ldap.secret <<EOR
dn: cn=<schoolname>-<roomname>,cn=raeume,cn=groups,ou=<schoolname>,$(ucr get ldap/base)
changetype: modify
add: ucsschoolRole
ucsschoolRole: veyon-backend:school:-
EOR
Hint
If multiple computer rooms are affected, the following bash script can automate this process across all rooms in a given OU.
When prompted, enter the OU name and the script will iterate over all computer rooms within that OU automatically.
The script should execute on the primary node.
#!/bin/bash
# Check if the script is running as root (required for ucr and /etc/ldap.secret)
if [ "$EUID" -ne 0 ]; then
echo "Please run this script as root."
exit 1
fi
# Prompt the user for the target OU before proceeding
read -rp "Enter the OU name to process: " TARGET_OU
if [ -z "$TARGET_OU" ]; then
echo "Error: No OU provided. Exiting."
exit 1
fi
echo ""
echo "Start: Fixing Veyon roles for OU '${TARGET_OU}'..."
# Dynamically retrieve the UCS LDAP base from UCR
LDAP_BASE=$(ucr get ldap/base)
ADMIN_DN="cn=admin,$LDAP_BASE"
PWD_FILE="/etc/ldap.secret"
# Build the search base path for computer rooms in the specified OU
SEARCH_BASE="cn=raeume,cn=groups,ou=${TARGET_OU},$LDAP_BASE"
echo "Searching for rooms in: $SEARCH_BASE"
# Find all room DNs
# -o ldif-wrap=no prevents long LDAP paths from being line-wrapped
# -s one searches exactly one level below "cn=raeume"
ROOM_DNS=$(ldapsearch -LLL -o ldif-wrap=no -x -D "$ADMIN_DN" -y "$PWD_FILE" \
-b "$SEARCH_BASE" -s one dn | grep -i "^dn: " | sed 's/^dn: //i')
# Check whether any rooms were found
if [ -z "$ROOM_DNS" ]; then
echo "Error: No rooms found or LDAP query failed."
exit 1
fi
# Loop over all discovered room DNs
# IFS is set to newline to safely handle spaces in DNs
IFS=$'\n'
for DN in $ROOM_DNS; do
echo "--------------------------------------------------------"
echo "Processing room: $DN"
# Delete the veyon-backend role attribute
echo " -> Deleting ucsschoolRole..."
ldapmodify -x -D "$ADMIN_DN" -y "$PWD_FILE" <<EOR
dn: $DN
changetype: modify
delete: ucsschoolRole
ucsschoolRole: veyon-backend:school:-
EOR
# Brief pause to avoid overloading the LDAP server and its listeners
sleep 1
# Re-add the veyon-backend role attribute
echo " -> Re-adding ucsschoolRole..."
ldapmodify -x -D "$ADMIN_DN" -y "$PWD_FILE" <<EOR
dn: $DN
changetype: modify
add: ucsschoolRole
ucsschoolRole: veyon-backend:school:-
EOR
echo "Done with room: $DN"
done
echo "--------------------------------------------------------"
echo "All rooms in OU '${TARGET_OU}' have been updated."
Make the script executable:
chmod +x fix-veyon-rooms.sh
Execute the script as root:
./fix-veyon-rooms.sh
Output from my test system:
root@ucs5primary:~# ./fix-veyon-rooms.sh
Enter the OU name to process: Heisenberg
Start: Fixing Veyon roles for OU 'Heisenberg'...
Searching for rooms in: cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet
--------------------------------------------------------
Processing room: cn=Heisenberg-Testraum01,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet
-> Deleting ucsschoolRole...
modifying entry "cn=Heisenberg-Testraum01,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet"
-> Re-adding ucsschoolRole...
modifying entry "cn=Heisenberg-Testraum01,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet"
Done with room: cn=Heisenberg-Testraum01,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet
--------------------------------------------------------
Processing room: cn=Heisenberg-PrinterGroupHeisenberg,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet
-> Deleting ucsschoolRole...
modifying entry "cn=Heisenberg-PrinterGroupHeisenberg,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet"
-> Re-adding ucsschoolRole...
modifying entry "cn=Heisenberg-PrinterGroupHeisenberg,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet"
Done with room: cn=Heisenberg-PrinterGroupHeisenberg,cn=raeume,cn=groups,ou=Heisenberg,dc=miro,dc=intranet
--------------------------------------------------------
All rooms in OU 'Heisenberg' have been updated.