Problem:
You add a “teachers and staff” user on the master but the object is synchronized and deleted again on a educativ slave
Solution:
If the user is added via the “common” user modul and not via the school user module, some exclusive adjustments are not made, so the replication mechanism does not cover everything.
The school-user module does some adjustments in the backgroud.
Adding a school user via the school-user module is the appropriate way, to add a new student, teacher, staff and ‘teacher and staff’
Additional:
The staff role is only synchronized to management servers that have the same OU as the educational server.
We have added a new ucr variable with ucs 4.3 to enable the sync after all.
To enable that feature you have to do the following steps on your master and (if existing) your backup, too
(Update: 20190926)
The ucr variable has to be set on every school slave, not just the master or backup)
# ucr set ucsschool/ldap/replicate_staff_to_edu=yes
Create ucsschool/ldap/replicate_staff_to_edu
# ucr commit /etc/ldap/slapd.conf
Multifile: /etc/ldap/slapd.conf
# service slapd restart
You can check with
# univention-ldapsearch -LLL '(&(objectClass=ucsschoolStaff)(!(objectClass=ucsschoolTeacher)))' dn | grep dn: | wc -l
Or on your edu-slave with:
# univention-ldapsearch -LLL '(&(objectClass=ucsschoolStaff)(!(objectClass=ucsschoolTeacher)))' dn | grep dn: | wc -l
or with the computer account:
# ldapsearch -xLLL -h $(ucr get ldap/master):7389 -D $(ucr get ldap/hostdn) -w $(cat /etc/machine.secret) '(&(objectClass=ucsschoolStaff)(!(objectClass=ucsschoolTeacher)))' dn | grep dn: | wc -l
If you have staff users, which are not automatically replicated after the change, make sure you have tried to trigger them to get them replicated. You can change the attribute description to trigger the replication again.
Or use the univention-replicate-one command
univention-replicate-one --dn uid=c.schein,cn=mitarbeiter,cn=users,ou=sun,dc=schein,dc=me