{"record":{"id":"0feb0d8154a1b771","repo":"gravitational/teleport","slug":"failed-to-delete-a-role-that-is-still-in-use-by-a","errorCode":null,"errorMessage":"failed to delete a role that is still in use by a user, check the system server logs for more details","messagePattern":"failed to delete a role that is still in use by a user, check the system server logs for more details","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/access.go","lineNumber":106,"sourceCode":"\n\tif err := a.emitter.EmitAuditEvent(a.closeCtx, &apievents.RoleCreate{\n\t\tMetadata: apievents.Metadata{\n\t\t\tType: events.RoleCreatedEvent,\n\t\t\tCode: events.RoleCreatedCode,\n\t\t},\n\t\tUserMetadata: authz.ClientUserMetadata(ctx),\n\t\tResourceMetadata: apievents.ResourceMetadata{\n\t\t\tName: role.GetName(),\n\t\t},\n\t\tConnectionMetadata: authz.ConnectionMetadata(ctx),\n\t}); err != nil {\n\t\ta.logger.WarnContext(ctx, \"Failed to emit role create event.\", \"error\", err)\n\t}\n\treturn upserted, nil\n}\n\nvar (\n\terrDeleteRoleUser       = errors.New(\"failed to delete a role that is still in use by a user, check the system server logs for more details\")\n\terrDeleteRoleCA         = errors.New(\"failed to delete a role that is still in use by a certificate authority, check the system server logs for more details\")\n\terrDeleteRoleAccessList = errors.New(\"failed to delete a role that is still in use by an access list, check the system server logs for more details\")\n)\n\n// DeleteRole deletes a role and emits a related audit event.\nfunc (a *Server) DeleteRole(ctx context.Context, name string) error {\n\t// check if this role is used by CA or Users\n\tusers, err := a.Services.GetUsers(ctx, false)\n\tif err != nil {\n\t\treturn trace.Wrap(err)\n\t}\n\tfor _, u := range users {\n\t\tif slices.Contains(u.GetRoles(), name) {\n\t\t\t// Mask the actual error here as it could be used to enumerate users\n\t\t\t// within the system.\n\t\t\ta.logger.WarnContext(\n\t\t\t\tctx, \"Failed to delete role: role is still in use by a user\",\n\t\t\t\t\"role\", name, \"user\", u.GetName(),","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/access.go#L88-L124","documentation":"DeleteRole refuses to delete a role that is still referenced by at least one user. errDeleteRoleUser is returned after the auth server logs which user still uses the role; the generic message intentionally defers details to server logs. The delete is a no-op for safety.","triggerScenarios":"Calling auth Server.DeleteRole(ctx, name) while any user's roles list contains that role name (iteration over a.Services.GetUsers finds a match).","commonSituations":"Admins deleting roles via tctl or the management API without realizing default or active users still carry the role; access-management automation deleting roles before unassigning them from users.","solutions":["Check auth server logs to find which user(s) still use the role.","Remove the role from each user (update user traits/roles via tctl users update or UpdateUser) and retry DeleteRole.","If the role should never have been assigned, reassign users to a replacement role first, then delete."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"users, _ := authClient.GetUsers(ctx, false)\nfor _, u := range users { if slices.Contains(u.GetRoles(), roleName) { return fmt.Errorf(\"role %q still used by user %q\", roleName, u.GetName()) } }","typeGuard":"if errors.Is(err, auth.ErrDeleteRoleUser) { /* role in use by a user */ }","tryCatchPattern":"err := authServer.DeleteRole(ctx, roleName)\nif errors.Is(err, auth.ErrDeleteRoleUser) {\n    return trace.BadParameter(\"remove the role from all users before deleting it (see server logs)\")\n}","preventionTips":["Before deleting, list users and check their roles for the target role.","Automate role replacement: migrate users to a new role in one workflow before deleting the old one.","Use access lists instead of per-user role assignments to reduce dangling references."],"tags":["rbac","roles","referential-integrity"],"backgroundTag":"resource-still-in-use","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}