RevokeRoleGrant fails for missing ADMIN CONFIGURATION role

Question

hi all
I am using the API and authenticating as xelsysadm. I am able to read all of the roles associated to a user
but cannot revoke any.
I get the following error message.
oracle.iam.identity.exception.ValidationFailedException: IAM-3056134:Role SYSTEM CONFIGURATION ADMINISTRATORS is NOT granted to user System Operator.:SYSTEM CON
FIGURATION ADMINISTRATORS:System Operator
I added SYSTEM CONFIGURATION ADMINISTRATORS role to xelsysadm and ran the role api and it shows up.
I added the OPERATORS role to a new user and when I try to remove the OPERATORS role from that new user is when I get the error.
Thanx
Fred
Edited by: Foresterf on Jul 22, 2011 1:33 PM

Answer 1

hi sunny,
I do not see a user called "System Operator". Do I need to add any roles to xelsysadm for this to work?
here is the code usrKey=21 roleid=2 is the only entry in the roleKeySet.
try
roleOp.revokeRoleGrant(usrKey, roleKeySet);
catch(ValidationFailedException vfe)
logger.error("ValidationFailedException",vfe);
throw new AIHelperException(vfe);
catch (AccessDeniedException ex)
logger.error("AccessDeniedException",ex);
throw new AIHelperException(ex);
catch(RoleGrantRevokeException ex)
logger.error("RoleGrantRevokeException",ex);
throw new AIHelperException(ex);
here is the logging of my code.
DEBUG,22 Jul 2011 22:13:06,201,[AI.AIOIMCLIENT][96],getting User
DEBUG,22 Jul 2011 22:13:06,625,[AI.AIOIMCLIENT][98],21
{Status=Active, [email protected], usr_key=21, User Login=MELFORESTER, Last Name=Forester, Xellerate Type=End-User, First Name=Melvin}
DirectReports:
DEBUG,22 Jul 2011 22:13:06,633,[AI.AIOIMCLIENT][99],getting User Roles
DEBUG,22 Jul 2011 22:13:06,732,[AI.AIOIMCLIENT][103],Role id = 2
{Role Display Name=OPERATORS, Role Unique Name=OPERATORS, ugp_create=Fri Apr 22 07:03:07 EDT 2011, Role Owner Key=1, Role Description=Operator role, Role Name=O
PERATORS, ugp_update=Fri Apr 22 07:03:07 EDT 2011, Role Namespace=Default, Role Key=2, LDAP GUID=null, ugp_updateby=1, Role Category Key=2, ugp_data_level=1, Ro
le Email=null, LDAP DN=null}
DEBUG,22 Jul 2011 22:13:06,751,[AI.AIOIMCLIENT][103],Role id = 3
{Role Display Name=ALL USERS, Role Unique Name=ALL USERS, ugp_create=Fri Apr 22 07:03:07 EDT 2011, Role Owner Key=1, Role Description=Default role for all users
, Role Name=ALL USERS, ugp_update=Fri Apr 22 07:03:07 EDT 2011, Role Namespace=Default, Role Key=3, LDAP GUID=null, ugp_updateby=1, Role Category Key=2, ugp_dat
a_level=1, Role Email=null, LDAP DN=null}
DEBUG,22 Jul 2011 22:13:06,760,[AI.AIOIMCLIENT][110],Revoking OPERATORS Role
DEBUG,22 Jul 2011 22:13:06,845,[AI.OIMHELPER][139],Adding role to revoke list 2
DEBUG,22 Jul 2011 22:13:06,920,[AI.OIMHELPER][151],Revoking roles from user id 21 entityid 21
ERROR,22 Jul 2011 22:13:08,222,[AI.OIMHELPER][158],ValidationFailedException
oracle.iam.identity.exception.ValidationFailedException: IAM-3056134:Role SYSTEM CONFIGURATION ADMINISTRATORS is NOT granted to user System Operator.:SYSTEM CON
FIGURATION ADMINISTRATORS:System Operator
at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:234)
at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:348)
at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:259)
at oracle.iam.identity.rolemgmt.api.RoleManager_ogut7n_RoleManagerRemoteImpl_1033_WLStub.revokeRoleGrantx(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at weblogic.ejb.container.internal.RemoteBusinessIntfProxy.invoke(RemoteBusinessIntfProxy.java:85)
at $Proxy2.revokeRoleGrantx(Unknown Source)
at oracle.iam.identity.rolemgmt.api.RoleManagerDelegate.revokeRoleGrant(Unknown Source)
Thanx
Fred