-
Title
Error: "You are not allowed to delete objects outstanding in the external system" when removing ADSAccount from AD group manually -
Description
Identity Manager is reporting error: "You are not allowed to delete objects outstanding in the external system" when removing ADSAccount from the Active Directory group manually. When performing a full synchronization, the job server log is reporting the error:
"ERROR (VI.FormBase.ExceptionMgr ) : Object (**SC-Funding) could not be saved! VI.DialogEngine.DialogEngineException: Object (**SC-Funding) could not be saved! ---> System.AggregateException: One or more errors occurred. ---> VI.Base.ViException: Error during execution of 'OnSaving' in logic module 'VI.DB.Entities.XOriginEntityLogic'. ---> VI.Base.ViException: You are not allowed to delete objects outstanding in the external system.
at VI.DB.Entities.XOriginEntityLogic.d__a.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)"
NOTE: This error may also occur if ADSGroups are deleted in the "Target system synchronization: Active Directory” form in Manager and the groups have members (entries in ADSAccountInADSGroup), e.g.:
"Error saving 013dd796-a761-4674-9926-263986079dbe - d85050e3-80aa-42ad-b668-b2f39048b9a2: [810319] You are not allowed to delete objects outstanding in the external system." -
Cause
The error is reported because the membership exists in Identity Manager but there is no matching membership in Active Directory. In this case, the synchronization marks the membership as outstanding. -
Resolution
1. Go to the "Target system synchronization: Active Directory” form in Manager to get an overview of all outstanding objects.
2. Select to delete the objects from the database or publish them into Active Directory.
If the outstanding objects are coming from an inherited membership then it will not be allowed to be deleted from the database - the "Delete" button will be greyed out. It does not make sense to delete such a membership because the source of the inheritance remains active and that’s why the system would recreate such an inherited membership during a recalculation. The source of the inheritance has to be removed in this case.