IdStory Identity Manager

Affected version: 7.8.2

This happens if there are at least 2 automatic roles for Contract_EAV and an identity has at least 2 contracts with different EAV settings.

• Create a form definition for EAV: "kodoblast"
• Create roles "Test", "Test2"
• Create an automatic rule for the role Test by Contract_EAV "kodoblast"="123"
• Create an automatic rule for the role Test2 by Contract_EAV "kodoblast"="456"
• Create an identity.
• Create a new identity contract and set its EAV attribute "kodoblast"="123". This assigns the automatic role Test
• Create a new identity contract and set its EAV attribute "kodoblast"="456". This adds the automatic role Test2 but it also removes Test

Please note that if there are e.g. 100 automatic roles, then the message "Request change in concept [7b623555-a60f-4223-99c6-15c08b161e9d], was not executed, because requested IdentityRole [bbf72996-905c-4b94-9d0a-fd1b0173d09c] was deleted (not from this role request)" appears 200x (with different IDs). This takes a long time - if the contract is created during synchronization, it looks like the synchronization is stuck.

Also, if I manually remove a contract, the automatic role (which was previously assigned thanks to this contract) is not deassigned from the identity.