Unlink\Unassign Error

Question

I am trying to unlink\unassign a user from a particular resource.
I get this error in the admin console:
com.waveset.util.WavesetException: You are not allowed to unassign resource account from User 001361393 since it is not directly assigned to the user. For example, you cannot unassign a resource account that was assigned indirectly through a role assignment
I also see the following error in the server.log file:
DeprovisionViewer: unable to correlate PROD-PFABRIZI
The account ID is: PROD-PFABRIZI
I have tried unassigning as
PROD-PFABRIZI
PA|PROD-PFABRIZI
Here is the work flow:
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Configuration PUBLIC 'waveset.dtd' 'waveset.dtd'>
<Configuration id='#ID#Configuration:TPC_Unlink_User_DomaninChg_SP' name='TPC_Unlink_User_DomaninChg_SP'>
<Extension>
<WFProcess name='TPC_Unlink_User_DomaninChg_SP' maxSteps='0'>
<Comments>Process to unassign/unlink AD and PA resource on a ID Domain Change.</Comments>
<Variable name='user' input='true' external='true'/>
<Variable name='resourceAccountAD'/>
<Variable name='resourceAccountPA'/>
<Variable name='totalacct'/>
<Variable name='ctr'/>
<Variable name='ADResourceAccountsMap'>
<new class='java.util.HashMap'/>
</Variable>
<Variable name='PAResourceAccountsMap'>
<new class='java.util.HashMap'/>
</Variable>
<Variable name='hostName'>
<Comments>Holds the Host Name of the environment where the Mail is triggered from. </Comments>
<rule name='TPC_GetServerDisplay'/>
</Variable>
<Variable name='deprovisionView'/>
<Variable name='appError' output='true'>
<Comments>Set to true if duplicate NTIC subprocess returns an error.</Comments>
</Variable>
<Activity id='0' name='start'>
<!-- <Transition to='Exception Notification'/> -->
<Transition to='GetResourceForUser'/>
<WorkflowEditor x='3' y='-74'/>
</Activity>
<Activity id='1' name='Exception Notification'>
<Action id='0' application='com.waveset.provision.WorkflowServices'>
<Argument name='op' value='notify'/>
<Argument name='template' value='TPC_ExceptionNotification_Email'/>
<Argument name='toAddress' value='[email protected]'/>
</Action>
<Transition to='GetResourceForUser'/>
<WorkflowEditor x='58' y='-75'/>
</Activity>
<Activity id='2' name='GetResourceForUser'>
<Action id='0' name='getresouce'>
<block name='invoke getting list' trace='true'>
<invoke name='makeList' class='com.waveset.util.Util'>
<invoke name='getResourceInfo'>
<invoke name='getObjectIfExists'>
<select>
<ref>context</ref>
<invoke name='getLighthouseContext'>
<ref>WF_CONTEXT</ref>
</invoke>
</select>
<s>User</s>
<ref>accountId</ref>
</invoke>
</invoke>
</invoke>
</block>
</Action>
<Transition to='Checkout deprovision View'/>
</Activity>
<Activity id='3' name='Checkout deprovision View'>
<!--<Variable name='view'/> may not be needed as the view is from the actuive -->
<Action id='-1' name='Checkout deprovision View' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='type' value='Deprovision'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='name' value='$(accountId)'/>
<Return from='view' to='deprovisionView'/>
</Action>
<Transition to='Set deprovision options PA'>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Transition>
<Transition to='end'/>
<WorkflowEditor x='205' y='-74'/>
</Activity>
<Activity id='4' name='Set Error'>
<Action id='0'>
<expression>
<set name='appError'>
<s>true</s>
</set>
</expression>
</Action>
<Transition to='end'/>
<WorkflowEditor x='432' y='-73'/>
</Activity>
<Activity id='5' name='Set deprovision options PA'>
<Action id='0' name='Get the PA reosurce'>
<expression>
<block name='Set Deprovision options PA' trace='true'>
<set name='resourceAccountPA'>
<rule name='TPC_GetResourceAccountsOfAResource_Rule'>
<argument name='resourceAccountsList'>
<rule name='TRV_Rul_getHashMapKeysUtil'>
<argument name='hashMapObject' value='$(deprovisionView.escapedNamesMap)'/>
</rule>
</argument>
<argument name='resourceName' value='PA'/>
</rule>
</set>
<set name='totalAccountPA'>
<length><ref>resourceAccountPA</ref></length>
</set>
<set name='ctr'>
<i>0</i>
</set>
</block>
</expression>
</Action>
<Action id='1' name='Get all the AD Accounts'>
<expression>
<block name='ACtion1 of Get all PA accounts' trace='true'>
<dolist name='PAresourceName'>
<ref>resourceAccountPA</ref>
<set name='PAresourceAccountName'>
<!--<ref>
<expand>
<s>deprovisionView.resourceAccounts.currentResourceAccounts[$(PAresourceName)].accountId</s>
</expand>
</ref> -->
<s>PA|PROD-PFABRIZI</s>
</set>
<upcase>
<ref>PAresourceAccountName</ref>
</upcase>
<block name='usernot in unload' trace='true'>
<set>
<expand>
<s>deprovisionView.resourceAccounts.currentResourceAccounts[$(PAresourceAccountName)].unlink</s>
</expand>
<s>true</s>
</set>
<set>
<expand>
<s>deprovisionView.resourceAccounts.currentResourceAccounts[$(PAresourceAccountName)].unassign</s>
</expand>
<s>true</s>
</set>
</block>
</dolist>
</block>
</expression>
</Action>
<Transition to='Checkin user View'/>
<WorkflowEditor x='485' y='-87'/>
</Activity>
<Activity id='6' name='Checkin user View'>
<Action id='0' name='Checkin user View' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkinView'/>
<Argument name='view' value='$(deprovisionView)'/>
</Action>
<Transition to='CheckinOK'>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Transition>
<Transition to='end'/>
<WorkflowEditor x='542' y='-19'/>
</Activity>
<Activity id='7' name='CheckinOK'>
<Action id='0'>
<block name='in checkingok' trace='true'>
<s>It would ok</s>
</block>
</Action>
<Transition to='end'/>
<WorkflowEditor x='542' y='-19'/>
</Activity>
<Activity id='8' name='end'>
<WorkflowEditor x='542' y='-19'/>
</Activity>
</WFProcess>
</Extension>
<MemberObjectGroups>
<ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
</MemberObjectGroups>
</Configuration>

Answer 1

Hi
I think your answer is in error itself and we know that if any resources is assigned by Role, so you have to unassign the role not the resources, because it is indirect assignement.
"you cannot unassign a resource account that was assigned indirectly through a role assignment"
So here you have to simply unassign the related role, resources will automatically removed from user account.
Hope it will help you.