Problem:
If there are users in LDAP that cannot log in OX, it may be that the attribute for the oxContext is missing for these users.
You can find more information about this in the following log file:
/var/log/univention/listener_modules/ox-connector.log
2023-06-19 16:50:00 INFO Modifying Object('users/user', 'uid=Administrator,cn=users,dc=ucs5hejne,dc=intranet')
2023-06-19 16:50:00 INFO Old Object('users/user', 'uid=Administrator,cn=users,dc=ucs5hejne,dc=intranet') has no context ID. Using new context ID instead...
2023-06-19 16:50:00 INFO Searching for Administrator in context 10
2023-06-19 16:50:00 INFO Error while processing /var/lib/univention-appcenter/apps/ox-connector/data/listener/2023-04-06-14-08-42-863910.json
2023-06-19 16:50:00 WARNING Traceback (most recent call last):
2023-06-19 16:50:00 WARNING File "/usr/lib/python3.9/site-packages/univention/ox/provisioning/users.py", line 376, in modify_user
2023-06-19 16:50:00 WARNING user_id = get_user_id(obj.old_attributes)
2023-06-19 16:50:00 WARNING File "/usr/lib/python3.9/site-packages/univention/ox/provisioning/users.py", line 304, in get_user_id
2023-06-19 16:50:00 WARNING context_id = get_context_id(attributes)
2023-06-19 16:50:00 WARNING File "/usr/lib/python3.9/site-packages/univention/ox/provisioning/helpers.py", line 57, in get_context_id
2023-06-19 16:50:00 WARNING raise Skip("Object has no oxContext attribute!")
2023-06-19 16:50:00 WARNING univention.ox.provisioning.helpers.Skip: Object has no oxContext attribute!
This could have happened for a several reasons. In my case it was a bug in the OX app suite in version 7.10.6-ucs4 that did not set the oxContext attribute in the LDAP.
Solution:
Scenario 1
One way to solve this problem, is to update the app ox-connector and OX-App-Suite. With the latest app suite version, the users where the oxContext is missing will be edited and the context 10 will be added.
Here is a short tutorial on how to update the apps via the terminal.
Note: The ox-connector app should be updated before the ox-app-suite because there is an dependancy .
- Update the Appcenter cache with:
univention-app update
- Install the upgrade for the ox-connector
univention-app upgrade ox-connector
- Install the upgrade for the OX-App-suite
univention-app upgrade oxseforucs
Scenario 2
If there are other users who cannot log in to OX, there is another way to fix this issue.
This is an option to filter out the users from LDAP that are missing the oxContext attribute and write the information into a file like modify_users.txt
univention-ldapsearch -LLL '(&(isOXUser=OK)(!(oxContextIDNum=*)))' dn | sed -ne 's,dn: ,,p' | xargs -I{} echo {} >> modify_users.txt
With the following udm command the users in the txt file, will be modifed and get the correct attribute for the oxContext.
while read -r dn; do
udm users/user modify --dn $dn --set oxContext=10
done < modify_users.txt
Scenario 3
There is also a script that checks the oxContext of the OX users. If there is an error, it corrects it and sets it correctly.
You will find an could use the script under:
/usr/sbin/fix_oxContext_attribute
Then, to be on the safe side, the join scripts should be run again with:
univention-run-join-scripts