Unable to remove deleted groups from role in RSA Governance & Lifecycle

3 years ago

Article Number

000069910

Applies To

RSA Product Set: RSA Governance & Lifecycle
RSA Version/Condition:

RSA Governance & Lifecycle 7.5.0
SecurID Governance & Lifecycle 7.5.2

Issue

When a role contains a deleted group as an entitlement, trying to remove the group from the role will remain at processing.

Cause

The previous behavior was to keep the deleted groups inside the role and mark them as deleted.

Resolution

This issue is resolved in the following versions by a behavior change:

SecurID Governance & Lifecycle 7.5.2 P08
RSA Governance & Lifecycle 8.0

Workaround

Contact RSA Customer Support and quote this KB article for a cleanup script for this issue.

Notes

The behavior change will only prevent the issue from occurring for all the groups that have a deletion date after applying the fixed version, for the groups with a deletion date before applying the fixed version a cleanup script is needed.

To check if there are any deleted groups that are still in a role, run the following SQL query that will detect all the invalid group entries in roles

select r.id role_id,r.name role_raw_name, r.alt_name role_name, g.id group_id,g.name group_name,rd.creation_date grp_added_to_role_on,g.deletion_date group_deletion_date 
from t_av_roles r inner join t_av_roledefinitions rd 
on r.id = rd.role_id
inner join t_groups g
on rd.ent_id = g.id
where rd.ent_type = 'group'and rd.deletion_date is null
and exists (select 1 from t_groups g where g.id = rd.ent_id and g.deletion_date is not null);

Don't see what you're looking for?

Related Articles

Trending Articles