It looks like users who are moved to the limbo / transfer school are not removed from every school group. The result is that the password reset for the previous classes or working groups don't work.
If someone has a similar problem, I wrote a simple shell script which shows the udm commands: cat remove-transfer-users-from-groups.sh #!/bin/bash eval $(ucr shell) univention-ldapsearch -b "ou=transfer,$ldap_base" '(&(ucsschoolRole=student:school:transfer)(uid=*))' dn | ldapsearch-wrapper | sed -ne 's|^dn: uid|uid|p' | while read u_dn; do univention-ldapsearch "(uniqueMember=$u_dn)" dn | ldapsearch-wrapper | sed -ne 's|^dn: cn|cn|p' | while read g_dn; do transfer="$(echo $g_dn | grep ',ou=transfer,')"; if [ -n "$transfer" ]; then continue; fi; echo udm users/user modify --dn \"$u_dn\" --remove groups=\"$g_dn\"; # udm users/user modify --dn "$u_dn" --remove groups="$g_dn"; done; done
It might help if we avoid the changing the group first and removing the member immediately afterwards. See 57260
Created attachment 11213 [details] Hook to diagnose group changes
All attempts to recreate this were futile and different approaches to rule various components out have not lead to success. Attached is a hook that can be used to diagnose group changes via the following steps: 1. Install file to /usr/lib/python3/dist-packages/univention/admin/hooks.d/log_user_group_transfers.py 2. Activate hook: udm settings/extended_attribute modify --dn "cn=ucsschoolRoleUsers,cn=UCSschool,cn=custom attributes,cn=univention,$(ucr get ldap/base)" --set hook=UcsschoolUserGroupTransfers 3. Restart Listener: service univention-directory-listener restart Now the tool should debug group changes to /var/log/univention/ucsschool-user-group-transfers.log After some data with affected users has been collected the hook should be deactivated: 1. udm settings/extended_attribute modify --dn "cn=ucsschoolRoleUsers,cn=UCSschool,cn=custom attributes,cn=univention,$(ucr get ldap/base)" --remove hook=UcsschoolUserGroupTransfers 2. service univention-directory-listener restart For the time being this bug will be outvoted by me as long as no new information is provided.
*** Bug 54829 has been marked as a duplicate of this bug. ***