Unable to remove roles from Users who have inherited them.

[tom_hs2]

Hi All,

I am System admin using Istanbul SN. I have some users who have left the business and they consumed fulfiller roles. They were assigned them through association with the group they were placed in. Upon taking them out of that group, it hasn't removed their roles. I then try and remove them manually, but it will not let me. This only seems to happen when the roles are showing as Inherited = true.

I go into the edit section on roles (one user has 22 roles) and absolutely no roles appear to transfer from selected back to available.

some of the users have no real dependencies, so removing the roles from them would not cause any issues. I do not want to log a customer support call every time i want to do some housekeeping with users who have left the company.

thanks in advance for you help.

Tom

[Edxavier Robert]

Hi @tom_hs2 , check this code to remove roles from the sys_user_has_role table, it would convert any inherited to false and the you can add the role that you want to remove. I create this under the scheduled jobs to run every day. This would remove the role for inactive users but you can modified the query. 

// Code to remove Base_User_Role and Read_Only_Requested_Items from users that are inactive

//query the sys_user table for only inactive users
var userlist = new GlideRecord('sys_user');
userlist.addQuery('active', 'false');
userlist.query();
while (userlist.next()) {

    // change the inherited to False, it would change to false any active role
    var grRemove = new GlideRecord('sys_user_has_role');
    //grRemove.addQuery('role.name', 'Base_User_Role'); 
    grRemove.addQuery('user', userlist.sys_id); //since users are inactive mark inherited false for all corresponding records
    grRemove.query();
    while (grRemove.next()) {
        grRemove.inherited = 'false';
        grRemove.update();
    }

    //add all the roles that you need to remove    
    // Delete the Base_User_Role, 
    var grRemove1 = new GlideRecord('sys_user_has_role');
    grRemove1.addQuery('role.name', 'Base_User_Role');
    grRemove1.addQuery('user', userlist.sys_id);
    grRemove1.query();
    while (grRemove1.next()) {
        grRemove1.deleteMultiple();
    }

    // Delete the Read_Only_Requested_Items record
    var grRemove2 = new GlideRecord('sys_user_has_role');
    grRemove2.addQuery('role.name', 'Read_Only_Requested_Items');
    grRemove2.addQuery('user', userlist.sys_id);
    grRemove2.query();
    while (grRemove2.next()) {
        grRemove2.deleteMultiple();
    }

    gs.log(userlist.name + " had the Base User Role and Read_Only_Requested_Items, but were removed.");
}

// To verified the log go to filter navigator and type "script log statements"

[Emmanuel Delez]

Hi Robert
It help me to remove those unlinked roles

[vijayakolli]

var roleRecord = new GlideRecord("sys_user_has_role");

roleRecord.addEncodedQuery('<add inactive / deleted roel record query >');

roleRecord.query();

gs.print("roleRecord " + roleRecord.getRowCount());

while (roleRecord.next()) {

roleRecord.inherited = false;

roleRecord.update();

roleRecord.deleteRecord();

}