Today I wanted to move some of our user objects from their usual place in "cn=users,$base_dn" to a sub-container "cn=MitarbeiterInnen,cn=users,$base_dn". I logged in as user "mbunkus", navigated to the LDAP module, created the sub-container (including adding it to the default user container). Then I selected a couple of user objects in "cn=users" including the object "uid=mbunkus,cn=users,$base_dn" — the one I had used to log in to the UMC.

The move process started, but right in the middle of moving "uid=mbunkus" it aborted with something like "access to UMC denied". I then logged back in to UMC, again as "uid=mbunkus".

The result was a partial move of that user object "uid=mbunkus". It was indeed moved to the new sub-container, however, the group membership hadn't been updated completely.

In a couple of groups the old entry was still present as "uniqueMember: uid=mbunkus,cn=users,$base_dn". In other groups both the old entry and the new one were present:

------------------------------------------------------------
[0 root@trinculo ~] univention-ldapsearch cn=kace-admins dn uniqueMember|ldapsearch-wrapper
# extended LDIF
#
# LDAPv3
# base <dc=bs,dc=linet-services,dc=de> (default) with scope subtree
# filter: cn=kace-admins
# requesting: dn uniqueMember
#

# kace-admins, groups, bs.linet-services.de
dn: cn=kace-admins,cn=groups,dc=bs,dc=linet-services,dc=de
uniqueMember: uid=mbunkus,cn=users,dc=bs,dc=linet-services,dc=de
uniqueMember: uid=mbunkus,cn=mitarbeiterinnen,cn=users,dc=bs,dc=linet-services,dc=de
------------------------------------------------------------

Fixing it wasn't that hard, but tedious: edit each group, remove all occurrences of the affected user, re-add the user, save.