Issue occurs, when recount automatic roles is skipped (e.g. from synchronization).
How to find data to fix:
select ir.* from idm_identity_role ir, idm_identity_contract ic
where ir.identity_contract_id = ic.id and (ic.valid_till <> ir.valid_till or ic.valid_from <> ir.valid_from) and automatic_role_id is not null;
EDIT 27.9.2023: we have to include even null validity and subroles, + we want to see the info about identity
EDIT 2 WARNING: these queries don't solve the situation when there are multiple levels of business roles (subroles assigned by subroles)
select i.username, ir.* from idm_identity_role ir, idm_identity_contract ic
join idm_identity i on ic.identity_id=i.id
where ir.identity_contract_id = ic.id and (ic.valid_till is null and ir.valid_till is not null OR ic.valid_till is not null and ir.valid_till is null OR ic.valid_till <> ir.valid_till or ic.valid_from <> ir.valid_from) and (automatic_role_id is not null or (ir.direct_role_id is not null and exists (select dr.id from idm_identity_role dr where dr.id = ir.direct_role_id and dr.automatic_role_id is not null)));
How to fix data on PostgreSql:
update idm_identity_role as ir set
valid_from = (select ic.valid_from from idm_identity_contract ic where ir.identity_contract_id = ic.id),
valid_till = (select ic.valid_till from idm_identity_contract ic where ir.identity_contract_id = ic.id)
where ir.automatic_role_id is not null
or (ir.direct_role_id is not null and exists (select dr.id from idm_identity_role dr where dr.id = ir.direct_role_id and dr.automatic_role_id is not null));
How to fix data on MSSql:
update ir set
valid_from = (select ic.valid_from from idm_identity_contract ic where ir.identity_contract_id = ic.id),
valid_till = (select ic.valid_till from idm_identity_contract ic where ir.identity_contract_id = ic.id)
from idm_identity_role ir
where ir.automatic_role_id is not null
or (ir.direct_role_id is not null and exists (select dr.id from idm_identity_role dr where dr.id = ir.direct_role_id and dr.automatic_role_id is not null));
Workaround: Unschedule IdentityRoleExpirationTaskExecutor until fix will be released.
