=== modified file 'dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata2/objectbundle/DefaultObjectBundleService.java'
--- dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata2/objectbundle/DefaultObjectBundleService.java	2016-03-15 09:37:19 +0000
+++ dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata2/objectbundle/DefaultObjectBundleService.java	2016-03-15 10:03:52 +0000
@@ -32,6 +32,7 @@
 import org.apache.commons.logging.LogFactory;
 import org.hibernate.Session;
 import org.hibernate.SessionFactory;
+import org.hisp.dhis.common.BaseIdentifiableObject;
 import org.hisp.dhis.common.IdentifiableObject;
 import org.hisp.dhis.common.IdentifiableObjectManager;
 import org.hisp.dhis.dbms.DbmsManager;
@@ -51,6 +52,7 @@
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 
@@ -355,7 +357,9 @@
             objectBundleHooks.forEach( hook -> hook.preCreate( object, bundle ) );
 
             preheatService.connectReferences( object, bundle.getPreheat(), bundle.getPreheatIdentifier() );
-            manager.save( object, bundle.getUser(), false );
+
+            prepare( object, bundle );
+            session.save( object );
 
             bundle.getPreheat().replace( bundle.getPreheatIdentifier(), object );
 
@@ -389,7 +393,8 @@
             persistedObject.mergeWith( object, bundle.getMergeMode() );
             persistedObject.mergeSharingWith( object );
 
-            manager.update( persistedObject, bundle.getUser() );
+            prepare( persistedObject, bundle );
+            session.update( persistedObject );
 
             objectBundleHooks.forEach( hook -> hook.postUpdate( persistedObject, bundle ) );
 
@@ -445,4 +450,12 @@
 
         return klasses;
     }
+
+    private void prepare( IdentifiableObject object, ObjectBundle bundle )
+    {
+        BaseIdentifiableObject identifiableObject = (BaseIdentifiableObject) object;
+
+        if ( identifiableObject.getUser() == null ) identifiableObject.setUser( bundle.getUser() );
+        if ( identifiableObject.getUserGroupAccesses() == null ) identifiableObject.setUserGroupAccesses( new HashSet<>() );
+    }
 }

=== modified file 'dhis-2/dhis-services/dhis-service-dxf2/src/test/java/org/hisp/dhis/dxf2/metadata2/objectbundle/ObjectBundleServiceTest.java'
--- dhis-2/dhis-services/dhis-service-dxf2/src/test/java/org/hisp/dhis/dxf2/metadata2/objectbundle/ObjectBundleServiceTest.java	2016-03-14 08:30:30 +0000
+++ dhis-2/dhis-services/dhis-service-dxf2/src/test/java/org/hisp/dhis/dxf2/metadata2/objectbundle/ObjectBundleServiceTest.java	2016-03-15 10:03:52 +0000
@@ -1134,6 +1134,8 @@
     @Test
     public void testCreateUsers() throws IOException
     {
+        createUserAndInjectSecurityContext( true );
+
         Map<Class<? extends IdentifiableObject>, List<IdentifiableObject>> metadata = renderService.fromMetadata(
             new ClassPathResource( "dxf2/users.json" ).getInputStream(), RenderFormat.JSON );
 
@@ -1144,11 +1146,11 @@
 
         ObjectBundle bundle = objectBundleService.create( params );
         ObjectBundleValidation validate = objectBundleService.validate( bundle );
-        assertTrue( validate.getObjectErrorReports().isEmpty() );
+        assertEquals( 1, validate.getErrorReportsByCode( UserAuthorityGroup.class, ErrorCode.E5003 ).size() );
         objectBundleService.commit( bundle );
 
         List<User> users = manager.getAll( User.class );
-        assertEquals( 3, users.size() );
+        assertEquals( 4, users.size() );
 
         User userA = manager.get( User.class, "sPWjoHSY03y" );
         User userB = manager.get( User.class, "MwhEJUnTHkn" );
@@ -1174,6 +1176,8 @@
     @Test
     public void testUpdateUsers() throws IOException
     {
+        createUserAndInjectSecurityContext( true );
+
         Map<Class<? extends IdentifiableObject>, List<IdentifiableObject>> metadata = renderService.fromMetadata(
             new ClassPathResource( "dxf2/users.json" ).getInputStream(), RenderFormat.JSON );
 
@@ -1184,7 +1188,7 @@
 
         ObjectBundle bundle = objectBundleService.create( params );
         ObjectBundleValidation validate = objectBundleService.validate( bundle );
-        assertTrue( validate.getObjectErrorReports().isEmpty() );
+        assertEquals( 1, validate.getErrorReportsByCode( UserAuthorityGroup.class, ErrorCode.E5003 ).size() );
         objectBundleService.commit( bundle );
 
         metadata = renderService.fromMetadata( new ClassPathResource( "dxf2/users_update.json" ).getInputStream(), RenderFormat.JSON );
@@ -1196,11 +1200,12 @@
 
         bundle = objectBundleService.create( params );
         validate = objectBundleService.validate( bundle );
-        assertTrue( validate.getObjectErrorReports().isEmpty() );
+        System.err.println( validate.getObjectErrorReports() );
+        assertEquals( 1, validate.getErrorReportsByCode( UserAuthorityGroup.class, ErrorCode.E5001 ).size() );
         objectBundleService.commit( bundle );
 
         List<User> users = manager.getAll( User.class );
-        assertEquals( 3, users.size() );
+        assertEquals( 4, users.size() );
 
         User userA = manager.get( User.class, "sPWjoHSY03y" );
         User userB = manager.get( User.class, "MwhEJUnTHkn" );