ErrCodeRoleHasAuthDomainMappings

ErrCodeRoleHasAuthDomainMappings

Error message

role is referenced by an SSO role mapping, remove it before deleting

What it means

Returned by the auth domain module's OnBeforeRoleDelete hook when the role being deleted is referenced by one or more SSO role mappings. Deleting it would leave dangling mappings, so the delete is blocked until the references are removed. The additional error data lists the auth domains that reference the role.

Source

Thrown at pkg/modules/authdomain/implauthdomain/getter.go:39

func (getter *getter) OnBeforeRoleDelete(ctx context.Context, orgID valuer.UUID, roleID valuer.UUID, roleName string) error {
	domains, err := getter.store.ListByOrgID(ctx, orgID)
	if err != nil {
		return err
	}

	referencedBy := make([]string, 0)
	for _, domain := range domains {
		for _, mappedRole := range domain.RoleMapping().RoleNames() {
			if mappedRole == roleName {
				referencedBy = append(referencedBy, domain.StorableAuthDomain().Name)
				break
			}
		}
	}

	if len(referencedBy) > 0 {
		return errors.WithAdditionalf(
			errors.New(errors.TypeInvalidInput, authtypes.ErrCodeRoleHasAuthDomainMappings, "role is referenced by an SSO role mapping, remove it before deleting"),
			"referenced by auth domain(s): %s", strings.Join(referencedBy, ", "),
		)
	}

	return nil
}

View on GitHub (pinned to 5069bf80b0)

Solutions

Inspect the additional error data ('referenced by auth domain(s): ...') to find which auth domains map to the role.
Remove or edit the SSO role mappings in those auth domains so they no longer reference the role.
Retry the role deletion.

Example fix

// before
currentRole := ... // mapped in authDomain spec roleMapping
api.DeleteRole(currentRole) // 400 ErrCodeRoleHasAuthDomainMappings

// after
// 1) update each authDomain's roleMapping to drop/rename the role
api.UpdateAuthDomain(authDomainWithoutMapping)
// 2) then delete
api.DeleteRole(currentRole)

Defensive patterns

Strategy: validation

Validate before calling

func roleIsReferenced(ctx context.Context, authDomains []authdomain.AuthDomain, roleID string) ([]string, bool) {
    var refs []string
    for _, ad := range authDomains {
        for _, m := range ad.Spec.RoleMapping {
            if m.Role == roleID { refs = append(refs, ad.Name) }
        }
    }
    return refs, len(refs) > 0
}

if refs, ok := roleIsReferenced(ctx, domains, roleID); ok {
    return fmt.Errorf("remove role mappings in %s first", strings.Join(refs, ", "))
}
err := api.DeleteRole(roleID)

Try / catch

err := api.DeleteRole(roleID)
if err != nil {
    if errors.Is(err, authtypes.ErrCodeRoleHasAuthDomainMappings) {
        // parse additional data for referencing domains, prompt user to detach
    }
    return err
}

Prevention

Before deleting roles, list auth domains and grep their roleMappings for the role.
Establish a deprecation flow: remove mappings first, then delete the role.

When it happens

Trigger: Attempting to delete a role (via role management API/UI) that is used in an authDomain roleMapping (e.g. mapping an SSO group claim to this role).

Common situations: Cleaning up unused roles after refactoring RBAC; syncing roles from an external SSO provider where mappings still point at the role; importing dashboards/configs that recreate mappings referencing a role slated for deletion.

Related errors

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/be3d38dc21c0bcfa. Report an issue: GitHub.