The User PUT get's all school groups, even if the user is not part of the respective school, like cn=OUschool2-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local (so not the classes + workgroups, but this adds up in large environments like the id broker) The problem seems to be located somewhere near get_udm_object (ucs-school-lib) { "dn": "uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local", "url": "https://10.207.200.56/ucsschool/kelvin/v1/users/demo_student", "ucsschool_roles": [ "student:school:DEMOSCHOOL" ], "udm_properties": { "accountActivationDate": { "activation-date": null, "activation-time": null, "activation-timezone": "Europe/Berlin" }, "displayName": "Demo Student", "divisNameAffix": null, "divisNickname": null, "e-mail": [ "demo_student@demoschool.example.com" ], "networkAccess": false, "PasswordRecoveryEmail": null, "PasswordRecoveryEmailVerified": null, "pwdChangeNextLogin": false, "serviceprovider": [], "ucsschoolPurgeTimestamp": null, "uidNumber": 2007 }, "name": "demo_student", "school": "https://10.207.200.56/ucsschool/kelvin/v1/schools/DEMOSCHOOL", "firstname": "Demo", "lastname": "Student", "birthday": null, "disabled": false, "email": "demo_student@demoschool.example.com", "expiration_date": null, "record_uid": "demo_student", "roles": [ "https://10.207.200.56/ucsschool/kelvin/v1/roles/student" ], "schools": [ "https://10.207.200.56/ucsschool/kelvin/v1/schools/DEMOSCHOOL" ], "school_classes": { "DEMOSCHOOL": [ "Democlass" ] }, "workgroups": {}, "source_uid": "DEMOID" } 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:417 'search' 'users/user' -> udm_users_user_object_search_with_http_info(**{'hidden': 'true', 'filter': 'uid=demo_student', 'scope': 'sub'}) -> UsersUserList(1 * UsersUser) [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.get_json:309 GET 'https://backup1.school.local/univention/udm/ldap/base/' (**{'headers': {'Accept': 'application/json', 'X-Request-ID': 'e5be5a5d1da1421997176923534f902d'}, 'auth': ('cn=admin', '********')}) -> 200 ('OK') 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up ImportUser with dn 'uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local' 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'users/user' -> udm_users_user_object_with_http_info(**{'dn': 'uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local'}) -> UsersUser('uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base.from_udm_obj:1054 UDM object uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local is not ImportUser, but actually ImportStudent 2022-11-04 05:12:30 INFO [238][e5be5a5d1d] pyhooks_loader.get_hook_classes:118 Searching for hooks of type 'UserPyHook' in: /var/lib/ucs-school-import/kelvin-hooks... 2022-11-04 05:12:30 INFO [238][e5be5a5d1d] pyhooks_loader.get_hook_classes:144 Found hook classes: 2022-11-04 05:12:30 INFO [238][e5be5a5d1d] pyhooks_loader.get_hook_objects:201 Loaded hooks: {}. 2022-11-04 05:12:30 INFO [238][e5be5a5d1d] base.modify_without_hooks:694 Modifying ImportStudent(name='demo_student', school='DEMOSCHOOL', dn='uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local') 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base.get_udm_object:913 Getting School UDM object by dn: ou=DEMOSCHOOL,dc=school,dc=local 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'container/ou' -> udm_container_ou_object_with_http_info(**{'dn': 'ou=DEMOSCHOOL,dc=school,dc=local'}) -> ContainerOu('ou=DEMOSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base.get_only_udm_obj:1160 Getting ImportStudent UDM object by filter: (&(!(uid=demo_student))(mailPrimaryAddress=demo_student@demoschool.example.com)) 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:417 'search' 'container/ou' -> udm_container_ou_object_search_with_http_info(**{'hidden': 'true', 'filter': '(objectClass=ucsschoolOrganizationalUnit)', 'scope': 'sub'}) -> ContainerOuList(4 * ContainerOu) [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up School with dn 'ou=DEMOSCHOOL,dc=school,dc=local' 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'container/ou' -> udm_container_ou_object_with_http_info(**{'dn': 'ou=DEMOSCHOOL,dc=school,dc=local'}) -> ContainerOu('ou=DEMOSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUdemoschool-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUdemoschool-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUdemoschool-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUdemoschool-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up School with dn 'ou=school1,dc=school,dc=local' 2022-11-04 05:12:30 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'container/ou' -> udm_container_ou_object_with_http_info(**{'dn': 'ou=school1,dc=school,dc=local'}) -> ContainerOu('ou=school1,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUschool1-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUschool1-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUschool1-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUschool1-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up School with dn 'ou=school2,dc=school,dc=local' 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'container/ou' -> udm_container_ou_object_with_http_info(**{'dn': 'ou=school2,dc=school,dc=local'}) -> ContainerOu('ou=school2,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUschool2-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUschool2-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUschool2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUschool2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up School with dn 'ou=TESTSCHOOL,dc=school,dc=local' 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'container/ou' -> udm_container_ou_object_with_http_info(**{'dn': 'ou=TESTSCHOOL,dc=school,dc=local'}) -> ContainerOu('ou=TESTSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUtestschool-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUtestschool-DC-Edukativnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=OUtestschool-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local'}) -> GroupsGroup('cn=OUtestschool-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.get_udm_object:913 Getting MailDomain UDM object by dn: cn=demoschool.example.com,cn=domain,cn=mail,dc=school,dc=local 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'mail/domain' -> udm_mail_domain_object_with_http_info(**{'dn': 'cn=demoschool.example.com,cn=domain,cn=mail,dc=school,dc=local'}) -> MailDomain('cn=demoschool.example.com,cn=domain,cn=mail,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.get_only_udm_obj:1160 Getting SchoolClass UDM object by filter: name=Democlass 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.call_hooks:497 Starting Group.call_hooks('pre', 'create') for Group(name='Domain Users DEMOSCHOOL', school='DEMOSCHOOL', dn='cn=Domain Users DEMOSCHOOL,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local'). 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] uldap_docker.__open:321 establishing new connection with retry_max=11 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] uldap_docker.bind:291 bind binddn=cn=admin,dc=school,dc=local 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] pyhooks_loader.get_hook_classes:118 Searching for hooks of type 'Hook' in: /var/lib/ucs-school-lib/kelvin-hooks... 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] pyhooks_loader.get_hook_classes:144 Found hook classes: 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] pyhooks_loader.get_hook_objects:201 Loaded hooks: {}. 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.get_only_udm_obj:1160 Getting Group UDM object by filter: name=Domain Users DEMOSCHOOL 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:417 'search' 'groups/group' -> udm_groups_group_object_search_with_http_info(**{'hidden': 'true', 'filter': 'name=Domain Users DEMOSCHOOL', 'position': 'dc=school,dc=local', 'scope': 'sub'}) -> GroupsGroupList(1 * GroupsGroup) [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.call_hooks:497 Starting SchoolClass.call_hooks('pre', 'create') for SchoolClass(name='DEMOSCHOOL-Democlass', school='DEMOSCHOOL', dn='cn=DEMOSCHOOL-Democlass,cn=klassen,cn=schueler,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local'). 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] uldap_docker.__open:321 establishing new connection with retry_max=11 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] uldap_docker.bind:291 bind binddn=cn=admin,dc=school,dc=local 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.get_only_udm_obj:1160 Getting SchoolClass UDM object by filter: name=DEMOSCHOOL-Democlass 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:417 'search' 'groups/group' -> udm_groups_group_object_search_with_http_info(**{'hidden': 'true', 'filter': 'name=DEMOSCHOOL-Democlass', 'position': 'dc=school,dc=local', 'scope': 'sub'}) -> GroupsGroupList(1 * GroupsGroup) [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.call_hooks:497 Starting Group.call_hooks('pre', 'create') for Group(name='schueler-DEMOSCHOOL', school='DEMOSCHOOL', dn='cn=schueler-DEMOSCHOOL,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local'). 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] uldap_docker.__open:321 establishing new connection with retry_max=11 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] uldap_docker.bind:291 bind binddn=cn=admin,dc=school,dc=local 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.get_only_udm_obj:1160 Getting Group UDM object by filter: name=schueler-DEMOSCHOOL 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:417 'search' 'groups/group' -> udm_groups_group_object_search_with_http_info(**{'hidden': 'true', 'filter': 'name=schueler-DEMOSCHOOL', 'position': 'dc=school,dc=local', 'scope': 'sub'}) -> GroupsGroupList(1 * GroupsGroup) [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up SchoolClass with dn 'cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local' 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local'}) -> GroupsGroup('cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:31 WARNING [238][e5be5a5d1d] base.from_udm_obj:1049 UDM object 'cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local' does not correspond to a Python class in the UCS school lib. 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.from_dn:1138 Looking up WorkGroup with dn 'cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local' 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'groups/group' -> udm_groups_group_object_with_http_info(**{'dn': 'cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local'}) -> GroupsGroup('cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:31 WARNING [238][e5be5a5d1d] base.from_udm_obj:1049 UDM object 'cn=schueler-demoschool,cn=groups,ou=DEMOSCHOOL,dc=school,dc=local' does not correspond to a Python class in the UCS school lib. 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.save:677 Modifications to UdmObject('users/user', 'uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local') found (ignore 'position'): {'options': {'pki': False, 'ucsschoolExam': False, 'ucsschoolStaff': False, 'ucsschoolStudent': True, 'ucsschoolTeacher': False, 'ucsschoolAdministrator': False}, 'position': 'cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local'} 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'update' 'users/user' -> udm_users_user_object_update_with_http_info(**{'users_user': {'options': {'pki': False, 'ucsschoolExam': False, 'ucsschoolStaff': False, 'ucsschoolStudent': True, 'ucsschoolTeacher': False, 'ucsschoolAdministrator': False}, 'position': 'cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local'}, 'dn': 'uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local'}) -> NoneType(None) [204] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:432 'get' 'users/user' -> udm_users_user_object_with_http_info(**{'dn': 'uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local'}) -> UsersUser('uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local') [200] 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base.get_only_udm_obj:1160 Getting ImportStudent UDM object by filter: username=demo_student 2022-11-04 05:12:31 DEBUG [238][e5be5a5d1d] base_http.call_openapi:417 'search' 'users/user' -> udm_users_user_object_search_with_http_info(**{'hidden': 'true', 'filter': 'username=demo_student', 'position': 'dc=school,dc=local', 'scope': 'sub'}) -> UsersUserList(1 * UsersUser) [200] 2022-11-04 05:12:31 INFO [238][e5be5a5d1d] base.modify_without_hooks:724 ImportStudent(name='demo_student', school='DEMOSCHOOL', dn='uid=demo_student,cn=schueler,cn=users,ou=DEMOSCHOOL,dc=school,dc=local') not modified. Nothing changed 2022-11-04 05:12:31 INFO [238][None] timing.emit:132 TIMING: Wall: 832.0ms | CPU: 221.1ms | ucsschool.kelvin.routers.user.complete_update 2022-11-04 05:12:31 INFO [238][None] h11_impl.send:480 172.17.42.1:59620 - "PUT /ucsschool/kelvin/v1/users/demo_student HTTP/1.1" 200
https://git.knut.univention.de/univention/components/ucsschool-kelvin-rest-api/-/issues/37