Indirect Relationship Processing fails with ORA-30926 and 'ORA-06512: at "AVUSER.CE_USERS" ' errors after Migration to 7.0.1 P02 of RSA Identity Governance & Lifecycle ORA-30926

[#1]

Article Number

000034893

Applies To

RSA Product Set: RSA Identity Governance & Lifecycle 
RSA Version/Condition: 7.0.1 P02
 

Issue

The indirect relationship processing task for account data collectors and/or entitlement data collectors fails with the following errors in the user interface (Admin > Monitoring > Run ID😞
 

Image description
 Task Details
com.aveksa.server.xfw.ExecutionException: com.aveksa.server.db.PersistenceException: java.sql.SQLException:
ORA-30926: unable to get a stable set of rows in the source tables
ORA-06512: at "AVUSER.CE_USERS", line 103
ORA-06512: at "AVUSER.CE_USERS", line 143
ORA-06512: at "AVUSER.COMMON_EXPLODER", line 435
ORA-06512: at "AVUSER.COMMON_EXPLODER", line 114
ORA-06512: at line 1
 

The following text is logged to the aveksaServer.log file ($AVEKSA_HOME/wildfly/standalone/log/aveksaServer.log):

ERROR (Exec Task Consumer#0) [com.aveksa.server.xfw.TaskExecutor] 
Failed method=Execute ExecutionTask[TaskID=XXXXXX RunID=XXXXXX Source=XXXX 
Type=EntitlementExplosionProcessing Status=InProgress] 
com.aveksa.server.xfw.ExecutionException: com.aveksa.server.db.PersistenceException: 
java.sql.SQLException: 
ORA-30926: unable to get a stable set of rows in the source tables
ORA-06512: at "AVUSER.CE_USERS", line 30
ORA-06512: at "AVUSER.CE_USERS", line 139
ORA-06512: at "AVUSER.COMMON_EXPLODER", line 435
ORA-06512: at "AVUSER.COMMON_EXPLODER", line 114
ORA-06512: at line 1

Please refer to RSA Knowledge Base Article 000030327 -- Artifacts to gather in RSA Identity Governance & Lifecycle to find the location of the aveksaServer.log file for your specific deployment if you are on a WildFly cluster or a non-WildFly platform. The aveksaServer.log may also be downloaded from the RSA Identity Governance & Lifecycle user interface (Admin > System > Server Nodes tab > under Logs).
 

Cause

This error occurs because of data duplication in the T_CE_EXPLICIT_RELATIONS table.

This is a known issue reported in engineering ticket ACM-71877.
 

Resolution

This issue is resolved in the following RSA Identity Governance & Lifecycle versions and patch levels:

• RSA Identity Governance & Lifecycle 7.0.1 P03
• RSA Identity Governance & Lifecycle 7.0.2 P01
• RSA Identity Governance & Lifecycle 7.1.0

Workaround

Run the following query as avuser using a SQL client such as SQL Developer. If the query returns any output, please contact RSA Identity Governance & Lifecycle Support and mention this RSA Knowledge Base Article ID 34893 for reference.

select * from t_ce_explicit_relations
where (entitled_id, entitled_type, entitlement_id, entitlement_type) in
(select entitled_id, entitled_type, entitlement_id, entitlement_type
from t_ce_explicit_relations
group by entitled_id, entitled_type, entitlement_id, entitlement_type
having count(*) > 1)
order by entitled_type, entitled_id, entitlement_id;

Notes

Related RSA Knowledge Base Articles:

• 000038826 -- Indirect Relationship Processing fails with ORA-30926 and 'ORA-06512: at "AVUSER.CE_USERS" ' errors when collecting Groups in RSA Identity Governance & Lifecycle
• 000034775 -- Indirect Relationship Processing fails with 'ORA-12899 value too large for column' error in RSA Identity Governance & Lifecycle