IdStory Identity Manager

On a technical note: RoleSynchronizationExecutor uses IdmRoleRequestService:createConcept where the validity is set. A simple fix is to create a method that doesn't do that but some further research is needed to make sure this functionality can surprise us elsewhere.

For check current status for valid till and manually added groups is possible use the sql query:

select distinct i.username, ir.valid_till from idm_identity_role as ir join idm_identity_contract ic on ic.id = ir.identity_contract_id join idm_identity i on i.id = ic.identity_id where ir.valid_till is not null and ir.automatic_role_id is null and ir.role_composition_id is null;

For remove all valid till for manually added groups you can use:

update idm_identity_role set valid_till = null where valid_till is not null and automatic_role_id is null and role_composition_id is null;