Problem: UCS@School - Exams and Kelvin API blocked by invalid firstname

Knowledge Base Community
, , , , ,
1

Kelvin REST API and Exam Creation Fail When Users Have Missing or Invalid firstname Attribute

Problem

When creating users in UCS or UCS@school, it is currently possible to omit the firstname attribute or to set it to invalid values (e.g., whitespace or special characters). While this is not enforced as a required field in LDAP/UMC, the ucsschool-kelvin-rest-api strictly requires a valid firstname.

If a user is created without a valid firstname, subsequent processes may fail with validation errors, including:

  • Kelvin REST API: Cannot list or manage users.
  • School Exam Creation: The creation process cannot proceed because affected students are rejected.

Example Kelvin API error:

{"detail":"Validation error when reading user 'uid=beratung,cn=users,ou=uni,dc=vention,dc=de': 1 validation error for UserModel\nfirstname\n  none is not an allowed value (type=type_error.none.not_allowed)"}

Example error during school exam creation:

Could not fulfill the request.

Server error message:

The following students have validation errors:

uid=leerzeichen,cn=schueler,cn=users,ou=mejneschool2,dc=ucs5schoolhejne,dc=intranet
firstname: "First name" is required. Please provide this information.

The student data must be corrected by an Administrator before the students can be added to the exam.

This behavior prevents the API and related components from functioning, even if only one user record is affected.

Environment

  • UCS: 5.0-10 errata1240

  • UCS@school 5.0 v7

  • UCS School Kelvin REST API: 1.10.3

  • Affected components:

    • ucsschool-kelvin-rest-api
    • School exam creation module
    • User creation via UMC/LDAP

Root Cause

This issue occurs because:

  1. The firstname attribute is not enforced as a mandatory field in LDAP/UMC.
  2. The Kelvin REST API and school exam creation processes require firstname to be set and not None.
  3. It is possible to create users with invalid firstname values such as spaces or certain special characters (e.g., " "), which leads to missing or malformed LDAP attributes.

Reference: Bug 58206

Impact

  • Kelvin REST API fails to process user data when even a single user lacks a valid firstname.
  • School exam creation cannot proceed if affected students are included.
  • Downstream UCS@school products relying on the API may be affected.
  • User synchronization, listing, or modification via API endpoints may break.

Workaround

Until a fix is provided, ensure all user accounts contain a valid firstname attribute:

  1. Check and correct existing users:

    • Add a meaningful firstname for all existing user accounts.
    • Avoid whitespace-only entries or unsupported special characters.

  2. Follow UCS@school user creation guidelines:

    • Use only valid characters: letters, underscores _, or hyphens - (e.g., for double names).
    • Avoid leading/trailing spaces and characters such as &%^$#@.

  3. Prevent invalid user creation:

    • If using import processes or automation, implement validation to enforce a proper firstname.

Refer to: How a UCS@school User Should Look Like