My Oracle Support Banner

"AccessDeniedException: IAM-3054101" Error: User With Admin Role Having Role Related Capabilities Is Unable to Delete Users from Role (Doc ID 2167532.1)

Last updated on APRIL 30, 2019

Applies to:

Identity Manager - Version 11.1.2.3.0 to 11.1.2.3.160719 [Release 11g]
Information in this document applies to any platform.

Symptoms

Admin user <ENDUSER_MANAGER> belonging to admin role <ADMIN_ROLE> with capabilities:

. Grant Role Memberships

. Revoke Role Memberships

. Role Modify

. Role View/Search

is unable to revoke user <USER> from a role <ROLE> when he/she also belongs to that role.

If he /she does not belong to role <ROLE> the revoke executes properly. 

The following exception is thrown when the issue reproduces:

[oracle.iam.identity.rolemgmt.utils] [tid: [ACTIVE].ExecuteThread: '9' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId:<ENDUSER_MANAGER>] [ecid:<ECID>]
[APP: oim#11.1.2.0.0] [DSID: ..] The operation on Role entity failed in the post-processing stage.[[ oracle.iam.platform.kernel.ValidationFailedException: IAM-3056217:Role was updated
successfully, but not all memberships were updated: An exception occurred while revoking role <ADMIN_ROLE> from users [<USER>]:
oracle.iam.identity.exception.AccessDeniedException: IAM-3054101:The logged-in user .. does not have deleteRoleMemberships permission on Role <ADMIN_ROLE> entity.:7:deleteRoleMemberships:Role:<ADMIN_ROLE>
:An exception occurred while revoking role <ADMIN_ROLE> from users [<USER>]: oracle.iam.identity.exception.AccessDeniedException:
IAM-3054101:The logged-in user .. does not have deleteRoleMemberships permission on Role <ADMIN_ROLE> entity.:7:deleteRoleMemberships:Role:<ADMIN_ROLE>
at oracle.iam.identity.utils.Utils.createValidationFailedException(Utils.java:1091)
at oracle.iam.identity.utils.Utils.createValidationFailedException(Utils.java:1074)
at oracle.iam.identity.rolemgmt.utils.RoleManagerUtils.createValidationFailedException(RoleManagerUtils.java:3245)  

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.