{"record":{"id":"e5bad216387bd72b","repo":"gravitational/teleport","slug":"failed-to-delete-a-role-that-is-still-in-use-by-a-e5bad2","errorCode":null,"errorMessage":"failed to delete a role that is still in use by a certificate authority, check the system server logs for more details","messagePattern":"failed to delete a role that is still in use by a certificate authority, check the system server logs for more details","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/access.go","lineNumber":107,"sourceCode":"\tif err := a.emitter.EmitAuditEvent(a.closeCtx, &apievents.RoleCreate{\n\t\tMetadata: apievents.Metadata{\n\t\t\tType: events.RoleCreatedEvent,\n\t\t\tCode: events.RoleCreatedCode,\n\t\t},\n\t\tUserMetadata: authz.ClientUserMetadata(ctx),\n\t\tResourceMetadata: apievents.ResourceMetadata{\n\t\t\tName: role.GetName(),\n\t\t},\n\t\tConnectionMetadata: authz.ConnectionMetadata(ctx),\n\t}); err != nil {\n\t\ta.logger.WarnContext(ctx, \"Failed to emit role create event.\", \"error\", err)\n\t}\n\treturn upserted, nil\n}\n\nvar (\n\terrDeleteRoleUser       = errors.New(\"failed to delete a role that is still in use by a user, check the system server logs for more details\")\n\terrDeleteRoleCA         = errors.New(\"failed to delete a role that is still in use by a certificate authority, check the system server logs for more details\")\n\terrDeleteRoleAccessList = errors.New(\"failed to delete a role that is still in use by an access list, check the system server logs for more details\")\n)\n\n// DeleteRole deletes a role and emits a related audit event.\nfunc (a *Server) DeleteRole(ctx context.Context, name string) error {\n\t// check if this role is used by CA or Users\n\tusers, err := a.Services.GetUsers(ctx, false)\n\tif err != nil {\n\t\treturn trace.Wrap(err)\n\t}\n\tfor _, u := range users {\n\t\tif slices.Contains(u.GetRoles(), name) {\n\t\t\t// Mask the actual error here as it could be used to enumerate users\n\t\t\t// within the system.\n\t\t\ta.logger.WarnContext(\n\t\t\t\tctx, \"Failed to delete role: role is still in use by a user\",\n\t\t\t\t\"role\", name, \"user\", u.GetName(),\n\t\t\t)","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/access.go#L89-L125","documentation":"DeleteRole also refuses deletion when the role is referenced by a certificate authority. errDeleteRoleCA is returned when any CA's role list includes the role; details (which CA) are written to server logs. This preserves CA trust configuration consistency.","triggerScenarios":"Calling Server.DeleteRole(ctx, name) while any cert authority resource (e.g. gotten via the CA service) lists the role among its roles, at lib/auth/access.go:143.","commonSituations":"Deleting a role used by a bot/CA trust configuration; migrations that reassign CA roles being run out of order; manually edited CA resources retaining stale role references.","solutions":["Inspect auth server logs to identify which CA still references the role.","Update the CA resource to remove/replace the role (e.g. via UpsertCertAuthority) then retry DeleteRole.","Verify with `tctl get cert_authority` which CAs mention the role before deleting."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"cas := authClient.GetCertAuthorities(ctx, caType, false)\nfor _, ca := range cas { if slices.Contains(ca.GetRoles(), roleName) { return fmt.Errorf(\"role %q used by CA %q\", roleName, ca.GetClusterName()) } }","typeGuard":"if errors.Is(err, auth.ErrDeleteRoleCA) { /* role in use by a certificate authority */ }","tryCatchPattern":"err := authServer.DeleteRole(ctx, roleName)\nif errors.Is(err, auth.ErrDeleteRoleCA) {\n    return trace.BadParameter(\"remove the role from all certificate authorities before deleting it\")\n}","preventionTips":["Audit cert authority resources (`tctl get cert_authority`) for the role before deletion.","Keep CA role assignments managed by the same automation that manages role lifecycle.","Search server logs for \"still in use by a certificate authority\" to pinpoint the CA."],"tags":["rbac","roles","certificate-authority","referential-integrity"],"backgroundTag":"resource-still-in-use","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}