[KULRICE-4153] Inactive qualifiers cause problems on existing roles Created: 10/May/10  Updated: 03/Nov/10  Resolved: 15/Sep/10

Status: Closed
Project: Kuali Rice Development
Component/s: Development
Affects Version/s: None
Fix Version/s: KFS Release 4.0, 1.0.3

Type: Bug Fix Priority: Blocker
Reporter: Dan Lemus (Inactive) Assignee: Emerson David (Inactive)
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: 2 days
Time Spent: Not Specified
Original Estimate: 2 days

Issue Links:
fixes KFSOLD-20098 Inactive qualifiers cause problems on... Closed
relates to KRRM-7 KIM Management Screens Open
Similar issues:
KULRICE-7263Passing Collections.emptyMap() as role qualifier causes failures in KIM
KULRICE-12836Role qualifiers lost on role maintenance document
KULRICE-7711Role qualifier validation being ignored when assigning a role as a member
KULRICE-7571Entering an document type qualifier on a Role document causes stack trace on add
KULRICE-4178Some role qualifiers displaying incorrectly
KULRICE-7605Person and Role document broken when displaying data with role that has namespace qualifier
KULRICE-8513Role document blows up if the attribute definition id of a qualifier contains a hyphen
KULRICE-1470KIM Qualified Role with multiple qualifications
KULRICE-6858If editing groups or roles, it validates the existence of all members before saving the doc, even those which are "inactive"
KULRICE-9165Person document not displaying role qualifiers
Rice Module:
Application Requirement:


You can't submit a role document listing an inactive org as a qualifying value for a user (such as KFS-SYS User or Accounting Reviewer). Inactivating the offending role doesn't help either. I wonder if we can either do some inactivation blocking on qualifying values based on their appearance on roles or handle inactive values differently if they're on pre-existing role members.

Comment by Jerry Neal (Inactive) [ 10/May/10 ]

I think this might be coming from KimTypeServiceBase#validateAttributes:

Map<String, List<String>> referenceCheckErrors = validateReferencesExistAndActive(kimType, attributes, validationErrors);
for ( String attributeName : referenceCheckErrors.keySet() ) {
List<String> attributeErrors = referenceCheckErrors.get(attributeName);
for ( String err : attributeErrors )

{ validationErrors.put(attributeName, err); }


Comment by Eric Westfall [ 01/Sep/10 ]

Setting this to blocker priority, because it is one of the 3 remaining issues for KFS 4.0.

Comment by Garey Taylor [ 08/Sep/10 ]

Adding Emerson's and Jerry's comments:

Hi Jerry,
Dan Lemus told me that you were the original reported on this issue. Is there a scenario that you are using or would use in one of the KFS instances to test out a solution for this issue?


Hi Emerson,

I think you could test using any role that takes org as a qualifier, for example KFS-SYS Organization Reviewer. Find any org that is used as a qualifier for one of the role assignments, then inactivate using the Org maintenance doc, then go back and try to edit the role assignment with that qualifier. It should at least allow you to inactive the role assignment.

Does that help?


Comment by Emerson David (Inactive) [ 09/Sep/10 ]

Solution is two-fold:
1) Find changes between the role members prior to submission with those upon submission
2) Validate only those being changed

This needs to happen either in IdentityManagementRoleDocumentRule.processCustomSaveDocumentBusinessRules() or IdentityManagementRoleDocumentRule.validateRoleQualifier().

Comment by Emerson David (Inactive) [ 13/Sep/10 ]

I changed up the solution a little bit. What we're going to do will follow this logic:
1) If a member is active on a Role on a Document, and they have an inactive Role Qualifier, Role Qualifier validation will fail
2) If a member is inactive on a Role on a Document, and they have an inactive Role Qualifier, Role Qualifier validation will pass

To that end, I created an Active Role Member Helper that will gather all members on a Role and return only the active members. Those active members are passed to the Role Qualifier validation (validateRoleQualifier). For all other validations, all members will still be passed in.

Comment by Emerson David (Inactive) [ 15/Sep/10 ]

Test scenario to be used in KFS CNV or REG instance:
Log in as "kggodfre"
1) Go to Administration -> Role
2) Find Role Name Organization Reviewer "org*rev*"
3) Edit - Description: Add bomiddle to role

  • Add member "bomiddle"
  • Name: bomiddle
  • Chart code: BA- Bloomington AUX
  • Org code: INAC
  • Document Type Name: ACCT
  • click add
  • Set Action Type Code to APPROVE
  • Set Action Policy Code to FIRST
    4) Submit

5) Go to Main Menu -> Organization Lookup
6) Find an active org like INAC
7) Edit

  • Description Deactivate INAC
  • Organization End Date: today's date
  • Active Indicator: uncheck
    8) Blanket Approve

9) Go to Administration -> Role
10) Find Role Name Organization Reviewer org*rev*
11) Edit
12) Description: Remove bomiddle from role
13) Set member bomiddle's Active To Dt to today
14) Submit

Document is submitted and bomiddle no longer is assigned to Role Organization Reviewer

Comment by Emerson David (Inactive) [ 15/Sep/10 ]

Dan, please refresh the Rice build in the KFS-CNV instance and test.

Generated at Mon Jul 06 15:58:59 CDT 2020 using JIRA 6.1.5#6160-sha1:a61a0fc278117a0da0ec9b89167b8f29b6afdab2.