Problem with AUTH_LDAP_USER_FLAGS_BY_GROUP on Zulip >= 4.0

Updating Zulip from 3.4 zu 4.2 broke my ldap sync, upon closer investigation I found the cause to be the extended set of roles: because I was using

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
        "is_realm_admin": "cn=someGroup,ou=filterGroups,dc=mydomain,dc=com",
}

I got the message

Exception: Ldap sync would have deactivated all owners of realm . This is most likely due to a misconfiguration of LDAP settings. Rolling back...
Use the --force option if the mass deactivation is intended.

Commenting out the above config block was not enough, I had to manually promote at least one user to OWNER for the sync to work again because there wasn’t any owner.

Then I tried adjusting my above config snippet from “is_realm_admin” to “is_realm_owner” - that did not work and completely broke the ldap sync right at the start (AttributeError: can't set attribute).

How can I get back the feature of having an LDAP group whose members are automatically assigned the highest possible role? The relevant docs are rather spartanic.

[debalance]

@sahil839 You’re right, now it’s working!

[sahil839]

I am not sure but I think the lines should be added after the code mentioned below to fix the NameError -

@property
    def is_realm_owner(self) -> bool:
        return self.role == UserProfile.ROLE_REALM_OWNER

@debalance can you try this once?