Unable to remove deleted groups from role in RSA Governance & Lifecycle
Last Modified: 2023-11-24
Article Number
000069910
Applies To
RSA Product Set: RSA Governance & Lifecycle
RSA Version/Condition: 
  • RSA Governance & Lifecycle 7.5.0
  • SecurID Governance & Lifecycle 7.5.2
Issue
When a role contains a deleted group as an entitlement, trying to remove the group from the role will remain at processing.

 
Cause
The previous behavior was to keep the deleted groups inside the role and mark them as deleted.
Resolution
This issue is resolved in the following versions by a behavior change:
  • SecurID Governance & Lifecycle 7.5.2 P08
  • RSA Governance & Lifecycle 8.0
Workaround
Contact RSA Customer Support and quote this KB article for a cleanup script for this issue. 
Notes
The behavior change will only prevent the issue from occurring for all the groups that have a deletion date after applying the fixed version, for the groups with a deletion date before applying the fixed version a cleanup script is needed.

To check if there are any deleted groups that are still in a role, run the following SQL query that will detect all the invalid group entries in roles
  
select r.id role_id,r.name role_raw_name, r.alt_name role_name, g.id group_id,g.name group_name,rd.creation_date grp_added_to_role_on,g.deletion_date group_deletion_date 
from t_av_roles r inner join t_av_roledefinitions rd 
on r.id = rd.role_id
inner join t_groups g
on rd.ent_id = g.id
where rd.ent_type = 'group'and rd.deletion_date is null
and exists (select 1 from t_groups g where g.id = rd.ent_id and g.deletion_date is not null);

 

Related Articles

Trending Articles

Don't see what you're looking for?