Unable to remove roles from Users who have inherited them.

[tom_hs2]

Hi All,

I am System admin using Istanbul SN. I have some users who have left the business and they consumed fulfiller roles. They were assigned them through association with the group they were placed in. Upon taking them out of that group, it hasn't removed their roles. I then try and remove them manually, but it will not let me. This only seems to happen when the roles are showing as Inherited = true.

I go into the edit section on roles (one user has 22 roles) and absolutely no roles appear to transfer from selected back to available.

some of the users have no real dependencies, so removing the roles from them would not cause any issues. I do not want to log a customer support call every time i want to do some housekeeping with users who have left the company.

thanks in advance for you help.

Tom

[Randall King]

I tried that but I get an error that I don't have access. I have admin and security admin, and I have elevated privileges.

[Slawek_Radziewi]

It is possible when role is not inherited. While role has value inherited it is not possible to change it state.

[aldred · Accepted solution]

I was suffering from the same issue as yourself, a user that despite not being in any groups was still inheriting roles (30 in my case) and was unable to remove them.

I was able to work around this as follows:

1. Navigate to the "sys_user_has_role" table as already mentioned in this thread.

2. Filter the results down to the username affected.

3. Export the list as an XML file.

4. Using your XML editor of choice, locate the "<inherited>true</inherited>" entry and replace it with "<inherited>false</inherited>".

5. Save the changes and import the XML file back into the sys_user_has_role table.

6. You should now be able to freely delete the roles from the user.

I double-checked to ensure that this caused no obvious errors and confirmed that the user was no longer able to access the applications associated with the removed roles.

Hope this helps.

[Srikanth Menava]

Hello Aldred,

 To add to the question. We had a recertification process recently. 

I had to remove some roles for users who are active.

But the roles were inherited from the group. So I cannot see it in the roles tab.

What should be done.

Thanks in Advance.

[Jordan Williams]

This didn't work for us (as of New York). I had to do it in a background script:

var role = new GlideRecord('sys_user_has_role');
role.get('<sys_id of role>');
role.inherited = false;
role.update();
role.deleteRecord();