IdStory Identity Manager

Issue occurs, when recount automatic roles is skipped (e.g. from synchronization).

How to find data to fix:

select ir.* from idm_identity_role ir, idm_identity_contract ic 
where ir.identity_contract_id = ic.id and (ic.valid_till <> ir.valid_till or ic.valid_from <> ir.valid_from) and automatic_role_id is not null;

EDIT 27.9.2023: we have to include even null validity and subroles, + we want to see the info about identity
EDIT 2 WARNING: these queries don't solve the situation when there are multiple levels of business roles (subroles assigned by subroles)

select i.username, ir.* from idm_identity_role ir, idm_identity_contract ic 
join idm_identity i on ic.identity_id=i.id
where ir.identity_contract_id = ic.id and (ic.valid_till is null and ir.valid_till is not null OR ic.valid_till is not null and ir.valid_till is null OR ic.valid_till <> ir.valid_till or ic.valid_from <> ir.valid_from) and (automatic_role_id is not null or (ir.direct_role_id is not null and exists (select dr.id from idm_identity_role dr where dr.id = ir.direct_role_id and dr.automatic_role_id is not null)));

How to fix data on PostgreSql:

update idm_identity_role as ir set 
valid_from = (select ic.valid_from from idm_identity_contract ic where ir.identity_contract_id = ic.id),
valid_till = (select ic.valid_till from idm_identity_contract ic where ir.identity_contract_id = ic.id)
where ir.automatic_role_id is not null
or (ir.direct_role_id is not null and exists (select dr.id from idm_identity_role dr where dr.id = ir.direct_role_id and dr.automatic_role_id is not null));

How to fix data on MSSql:

update ir set 
valid_from = (select ic.valid_from from idm_identity_contract ic where ir.identity_contract_id = ic.id),
valid_till = (select ic.valid_till from idm_identity_contract ic where ir.identity_contract_id = ic.id)
from idm_identity_role ir
where ir.automatic_role_id is not null
or (ir.direct_role_id is not null and exists (select dr.id from idm_identity_role dr where dr.id = ir.direct_role_id and dr.automatic_role_id is not null));

Workaround: Unschedule IdentityRoleExpirationTaskExecutor until fix will be released.

I've fixed updating validity for automatically assigned roles, when contract is changed + automatic role recount is skipped (broken by additional state for process skipped contracts #2418).
Change script is provided to fix data. It's placed in tool => will be efective for all fixed versinons 10.4.9 (10.5.4, 10.6.1).

Commit:
https://github.com/bcvsolutions/CzechIdMng/commit/418c51ede38b63665f0ca998e201c925286c0692

Could you provide me a feedback, please?

I did reivew and tested it on the version 10.4.9 and 10.6.1. Works correctly now.

Putting a change script to the tool module is genius.