Cannot remove roles for users that are "inherited", but the Role Inheritance Map shows no parent for the role.

[Adam Geil]

We are preparing to deploy CSM. An update set was pushed from dev to test. Now a large subset of users have been assigned the following roles:

• snc_external
• sn_apptmnt_booking.appointment_booking_user
• sn_customerservice.customer
• sn_esm_user
• task_activity_reader

These roles are listed as Inherited, but the Role Inheritance Map does not show a parent, so they cannot be removed. I attempted to delete the sys_user_has_role record for these, but I do not have the option to delete (using admin role).

Steps to reproduce:
Initially, these individuals had the sn_customerservice.customer and sn_customerservice.customer_case_manager roles. I removed these roles, but the child roles listed above remained tied to the user accounts. I attempted to delete the sys_user_has_role records for these users/roles, but I don’t have the option to delete the record despite my account having the admin, user_admin, and security_admin roles.

[Allen Andreas]

You can go to a user profile and scroll down to their roles and click Edit, from there, you'll notice instead of seeing like 8 roles, you will not only see maybe 1 or 2 as part of the "Selected" roles. This is because when there are nested roles, you'll see the full count of 8, for example, in their role tab, but when you go to edit, you'll see the top level which could just be 2 roles that the remaining 6 are coming from.

That should help give you an idea of where they are coming from.

Please mark reply as Helpful/Correct, if applicable. Thanks!

[Adam Geil]

Hey Allen,

Unfortunately for me, he only has two roles. Neither of these roles are parent roles for the sn_customerservice.customer role. This is ultimately the dilemma. These individuals seem to be stuck with "inherited" roles that weren't removed when the parent role was removed. 

[Allen Andreas]

Hello,

So if you slide both of those from the right to the left and save (just for testing)...there are roles remaining?

Have you tried to clear the instance cache by typing "cache.do" and pressing enter in left-hand navigation?

Please mark reply as Helpful/Correct, if applicable.  Thanks!

[Adam Geil]

Hey Allen,

That didn't do the trick either. HI got back to me, and it appears that they have to use their account with the "maint" role in order to remove this seemingly abandoned child sys_user_has_role records via the script below. 

We don't know what the root cause is for this issue though. I'll post another update when I get more info.

var roleRecord = new GlideRecord("sys_user_has_role");
roleRecord.addEncodedQuery('role.nameSTARTSWITHsn_customerservice.customer'); // ex query: 
roleRecord.query(); 

gs.print(">> " + roleRecord.getRowCount());
while (roleRecord.next()) {

    roleRecord.deleteMultiple(); 
}

[Allen Andreas]

Ah, ok. Sorry that my suggestions aren't resolving the issue. Definitely sounds a bit weird, but I'm glad you're getting assistance from HI.

Let us know in the end what all happened, if found.

Please mark reply as Helpful, if applicable. Thanks!