FMW Control fails to revoke Application Role from User/Group with EM-01076 error "Failed To Get WLS Groups", MBean Operation "findDefaultRealm()" For MBean, GetPrincipal() (Doc ID 2001009.1)

Last updated on DECEMBER 05, 2016

Applies to:

Enterprise Manager for Fusion Middleware - Version 11.1.1.6.0 and later
Oracle Platform Security for Java - Version 11.1.1.6.0 and later
Information in this document applies to any platform.

Symptoms

In Fusion Middleware 11.1.1.6 environments, when trying to revoke Application Roles from Fusion Middleware Control, also known as Enterprise Manager or EM, the revoke Role operation fails with error:

"Cannot remove principal from application role; principal "d79bd496-dae7-11e1-6277-b4f4678818b5" is not member of application role "BIAdministrator""

 
Note that the Role Name may vary depending on your install, and that the principal ID is listed, instead of the user/group name.

This issue is detected in FMW Environments having external users and groups imported from LDAP server (in the initial issue occurrence it was Tivoly LDAP server):

Detailed symptoms

  1. The problem can be reproduced for roles initially granted with FMWControl ONLY, which means
    • For new roles granted/revoked via WLST (with grantAppRole/revokeAppRole), both operations work in WLST
    • For new roles granted with WLST (with grantAppRole), FMW Control is able to revoke the Application Role in FMW Control, although the "id" is displayed instead of the user/group name
    • For new roles granted with FMW Control, neither FMWControl or WLST is able to revoke the applicatoin role either via WLST or via FMW Control.
       
  2. When looking at the log files you can find error messages:

     

Changes

 Some roles were granted via EM which can not be revoked now either from EM or from WLST

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms