IQSS / IQSS/dataverse

Deleting a user does not remove assigned roles

Open
#10,834 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type: Bug
Dominant language
Java
Stars
1.1k
Forks
564
Avg merge
2d 2h
Merged PRs (30d)
29

Description

What steps does it take to reproduce the issue?

  • When does this issue occur?
  1. Assign a role to user within a Dataverse Collection.
  2. Delete the user.
  3. Try to create a new subcollection.
    while :InheritParentRoleAssignments is true for the parent collection.
  • Which page(s) does it occurs on?
    Create new Dataverse.

  • What happens?
    createDVerror

  • To whom does it occur (all users, curators, superusers)?
    Anyone with the permission to create a new Dataverse Collection.

  • What did you expect to happen?
    Deleting a user should properly remove all assigned roles (or at least give a warning).
    The assigned role was only visible through the API, and not in the UI.
    Removing the assigned role manually via API fixed the error.

Which version of Dataverse are you using?
6.1

Any related open or closed issues to this bug report?

Screenshots:

No matter the issue, screenshots are always welcome.

To add a screenshot, please use one of the following formats and/or methods described here:

Are you thinking about creating a pull request for this issue?
Help is always welcome, is this bug something you or your organization plan to fix?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue by assigning a collection role, deleting the user, and creating a subcollection with InheritParentRoleAssignments enabled. Trace how user deletion handles role assignments and compare the API-visible state with the UI; done means deleted users leave no assignments that block subcollection creation, or the deletion flow warns about them.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.