Problem
After installing errata282, the ucs@school import process stops working. Specifically, Python raises an ImportError:
cannot import name 'get_roles_from_ldap' from 'univention.admin.guardian_roles'
This error originates from:
/usr/lib/python3/dist-packages/univention/admin/authorization/__init__.py
Root Cause
The issue is caused by a regression introduced with errata282, in which a new function (get_roles_from_ldap) was added to guardian_roles.py.
However, the affected services are still running old Python processes and have not yet reloaded the updated guardian_roles.py file.
Because these services load Python modules at startup, they continue using the outdated version in memory, which does not yet include the new function—resulting in the ImportError.
Since the import takes place in a base Python module (univention.admin.authorization), not a UCS@school-specific component, multiple services may be affected.
This regression is tracked here:
https://forge.univention.org/bugzilla/show_bug.cgi?id=58802
Solution
The recommended workaround is to restart the server, ensuring all affected Python services reload the updated module.
If a full reboot is not possible, restart the most likely impacted services manually. While the complete list of affected services is still unclear, the following set provides a reliable baseline:
systemctl restart \
ucsschool-id-connector_Container.service \
ucs-school-import-http-api.service \
ucs-school-import-celery-worker.service \
ucsschool-kelvin-rest-api_Container.service \
univention-directory-manager-rest.service \
univention-management-console-server.service
Restarting these services forces them to reload the updated Python module and should restore normal functionality until a permanent fix is released.