Active Roles fails to move or delete objects with the error "Access is denied" when edsvaProtectFromDeletion is enabled (4374090)

Active Roles fails to move or delete objects with the error "Access is denied" when edsvaProtectFromDeletion is enabled

When the edsvaProtectFromDeletion boolean is enabled (this is also exposed as the Protect object from accidental deletion checkbox in Active Roles clients), Active Roles policies and Workflows fail to move or delete an object with the error:

This is expected based on the current implementation of this option.

Enhancement Request 415721 has been created to modify the current product functionality in order to handle this configuration without throwing an error.

WORKAROUND

Add the following custom script module to a Deprovisioning Policy:
 

function onPreDeprovision($Request)
{
    if($Request.class -ne 'user'){return}

    try
    {    
        Set-QADUser ($Request.Get("distinguishedName")) -ObjectAttributes @{"edsvaProtectFromDeletion" = $false}
    }
    catch
    {
        throw "Failed to update edsvaProtectFromDeletion attribute"
    } 
}

 

STATUS

Enhancement Request ID 415721 has been created to change this functionality in Active Roles.

Product Management will evaluate the request and this feature may become available in a future release of the product.

There are no guarantees that this specific enhancement request will be implemented in a future release.

For more information regarding our Enhancement Request policy, refer to our Global Support Guide on the Support Portal at: https://support.oneidentity.com/essentials/support-guide/

415721