User with minimal required capabilities cannot delete a user

Description

Steps to Reproduce:

  1. Login to https://eureka-bugfest-ramsons-consortium.int.aws.folio.org/ tenant as a user with following capability sets assigned

    1. Central tenant:

      1. Data - UI-Users - View

      2. Data - UI-Users - Delete

      3. Data - UI-Users Open Transactions - View

  2. Go to "Users" app

  3. Open detailed view of any existing user

  4. Click on "Actions" button on the third pane → Select "Check for open transactions/delete user" option

  5. Click on “Yes“ button in appeared modal

Expected Results: A user is deleted without errors. Modal is closed, deleted user’s detailed view is closed, deleted user disappeared from users list.

Actual Results: A user is NOT deleted. Modal remains opened. Error pop-up appears. In DevTools DELETE /users-keycloak/users/<<UUID>> call fails with 403 status and the following response body:

Additional Information:

CSP Request Details

None

CSP Rejection Details

None

Potential Workaround

None

Attachments

4

Checklist

hide

Activity

Show:

Yauhen Viazau December 17, 2024 at 7:21 AM

Tested on Eureka BF

https://eureka-bugfest-ramsons-consortium.int.aws.folio.org/ - works as expected

Note: users w/out Keycloak record cannot be deleted due to

Cannot be tested on Eureka BF non-ECS due to

JenkinsNotifications December 16, 2024 at 4:50 PM

Deployed to the Ramsons bf env. Moved status to In bugfix review from status Awaiting deployment. Please proceed with the verification.

Yauhen Viazau December 10, 2024 at 8:03 AM
Edited

Cannot be tested on Eureka BF due to:

Yauhen Viazau December 9, 2024 at 4:24 PM

- please set the RCA group.

Yauhen Viazau December 9, 2024 at 4:23 PM

Tested on https://folio-etesting-snapshot-consortium.ci.folio.org/, https://folio-etesting-snapshot-diku.ci.folio.org/ - issue is not active

A user having a Keycloak record can be deleted without issues:

A user without a Keycloak record can be deleted. Although an error pop-up is shown because DELETE call returns with 404 status due to . But the user is still deleted, and no 403 errors shown.

 

Done

Details

Assignee

Reporter

Priority

Story Points

Sprint

Development Team

Eureka

Fix versions

Release

Ramsons (R2 2024) Bug Fix

RCA Group

Missing module permission

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs

Created November 18, 2024 at 9:29 AM
Updated January 28, 2025 at 1:51 PM
Resolved December 9, 2024 at 4:24 PM
TestRail: Cases
TestRail: Runs