{"record":{"id":"be3d38dc21c0bcfa","repo":"SigNoz/signoz","slug":"errcoderolehasauthdomainmappings","errorCode":"ErrCodeRoleHasAuthDomainMappings","errorMessage":"role is referenced by an SSO role mapping, remove it before deleting","messagePattern":"role is referenced by an SSO role mapping, remove it before deleting","errorType":"error_code","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/modules/authdomain/implauthdomain/getter.go","lineNumber":39,"sourceCode":"func (getter *getter) OnBeforeRoleDelete(ctx context.Context, orgID valuer.UUID, roleID valuer.UUID, roleName string) error {\n\tdomains, err := getter.store.ListByOrgID(ctx, orgID)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treferencedBy := make([]string, 0)\n\tfor _, domain := range domains {\n\t\tfor _, mappedRole := range domain.RoleMapping().RoleNames() {\n\t\t\tif mappedRole == roleName {\n\t\t\t\treferencedBy = append(referencedBy, domain.StorableAuthDomain().Name)\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(referencedBy) > 0 {\n\t\treturn errors.WithAdditionalf(\n\t\t\terrors.New(errors.TypeInvalidInput, authtypes.ErrCodeRoleHasAuthDomainMappings, \"role is referenced by an SSO role mapping, remove it before deleting\"),\n\t\t\t\"referenced by auth domain(s): %s\", strings.Join(referencedBy, \", \"),\n\t\t)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":21,"sourceCodeEnd":46,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/modules/authdomain/implauthdomain/getter.go#L21-L46","documentation":"Returned by the auth domain module's OnBeforeRoleDelete hook when the role being deleted is referenced by one or more SSO role mappings. Deleting it would leave dangling mappings, so the delete is blocked until the references are removed. The additional error data lists the auth domains that reference the role.","triggerScenarios":"Attempting to delete a role (via role management API/UI) that is used in an authDomain roleMapping (e.g. mapping an SSO group claim to this role).","commonSituations":"Cleaning up unused roles after refactoring RBAC; syncing roles from an external SSO provider where mappings still point at the role; importing dashboards/configs that recreate mappings referencing a role slated for deletion.","solutions":["Inspect the additional error data ('referenced by auth domain(s): ...') to find which auth domains map to the role.","Remove or edit the SSO role mappings in those auth domains so they no longer reference the role.","Retry the role deletion."],"exampleFix":"// before\ncurrentRole := ... // mapped in authDomain spec roleMapping\napi.DeleteRole(currentRole) // 400 ErrCodeRoleHasAuthDomainMappings\n\n// after\n// 1) update each authDomain's roleMapping to drop/rename the role\napi.UpdateAuthDomain(authDomainWithoutMapping)\n// 2) then delete\napi.DeleteRole(currentRole)","handlingStrategy":"validation","validationCode":"func roleIsReferenced(ctx context.Context, authDomains []authdomain.AuthDomain, roleID string) ([]string, bool) {\n    var refs []string\n    for _, ad := range authDomains {\n        for _, m := range ad.Spec.RoleMapping {\n            if m.Role == roleID { refs = append(refs, ad.Name) }\n        }\n    }\n    return refs, len(refs) > 0\n}\n\nif refs, ok := roleIsReferenced(ctx, domains, roleID); ok {\n    return fmt.Errorf(\"remove role mappings in %s first\", strings.Join(refs, \", \"))\n}\nerr := api.DeleteRole(roleID)","typeGuard":null,"tryCatchPattern":"err := api.DeleteRole(roleID)\nif err != nil {\n    if errors.Is(err, authtypes.ErrCodeRoleHasAuthDomainMappings) {\n        // parse additional data for referencing domains, prompt user to detach\n    }\n    return err\n}","preventionTips":["Before deleting roles, list auth domains and grep their roleMappings for the role.","Establish a deprecation flow: remove mappings first, then delete the role."],"tags":["authdomain","sso","rbac","role-mapping","delete-blocked"],"backgroundTag":"referenced-entity-delete-blocked","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}