Blocking error during upgrade Grant_AdminUser_Full_RightsOn_Root_ServiceType

Issue

During an upgrade (at least 5.6), you may run into the following error:

Grant_AdminUser_Full_RightsOn_Root_ServiceType

The K2:DOMAIN\DisabledUserInAD could not be found.


Cause

This is related to K2 5.6 introduction of Service Instance Security:

https://help.nintex.com/en-us/k2five/userguide/current/Content/K2-Management-Site/Integration/ServiceInstancesSecurity.htm


Where-in the Upgrade process will get users from the [Server].[ServerUser] tables to set as default administrators for Service Instances.  However, if the user is disabled in Active Directory and marked as not enabled in the K2 Identity Cache, then this step will fail.


Resolution

You can check which entries in the [Server].[ServerUser] is disabled via SQL, and remove these entries from the [Server].[ServerUser] table.  You can use the following to check:

SELECT * FROM [Server].[ServerUser] ssu 

JOIN [Identity].[Identity] ii 

ON ssu.[User] = ii.FQN 

WHERE ii.[Enabled] = 0 AND ii.[Type] = 1 AND ii.[Label] = 'K2'


Once removed, you can Recover the upgrade process.

Comments

Post a Comment

Popular posts from this blog

Blocking Error during K2 5.6 Server migration

  Error Encountered: Error during K2 5.6 migration to a new machine, keeping the SQL server unchanged. Error message:                       20:49:59:>> Certificates.FindCertificate: Found 1 certificates                       20:49:59:>> RegisterShard.Execute: Adding additonal connection string parameters to config service shard                       20:49:59:>> AdditionalConnectionStringParameters.AmendSQLConnectionString: Additional connection string parameter value: empty                       20:49:59:>> AdditionalConnectionStringParameters.AmendSQLConnectionString: Additional ConnectionString Parameters is empty                       20:50:04:>> AnalyzableAction.PopulateValidate...
Read more

Client Credentials flow with K2 Cloud with Odata, Workflow REST or SCIM

Image
This guide outlines the steps to using the Client Credentials Flow for accessing Nintex K2 Cloud's OData, Workflow REST, or SCIM APIs. Before you begin: Ensure your environment is eligible for Client Credentials Flow by contacting Nintex support ( https://customer.nintex.com/cases/Pages/default.aspx ). Have a SHA256 hash of the client secret of your choosing ready. Steps: Onboarding: Open a support ticket with Nintex requesting the onboarding of the Client Credentials Flow for your environment. Provide the SHA256 hash of your the client secret. https://help.nintex.com/en-US/k2cloud/userguide/current/Content/IdProviders/ClientCredentials.htm You can Generate the secret hash from a Client Secret value in a .NET console application. The onboarding team does not need the actual secret value, only the hash of it. Use the following steps and code example to generate the hash: Add the  IdentityModel  NuGet package. Add the  IdentityModel  library reference in the ...
Read more

Blocking error RegisterServiceInstanceObjects when upgrading to K2 5.6/5.7

K2 5.7 Upgrade Error: Blocking Issue with Orphaned Service Instances Error Message:             07:30:39:>> AuthorizationBase.RegisterServiceInstanceObjects: Current ServiceType and ServiceInstance details: ServiceType.Guid = GUIDValue1. ServiceInstance.Guid = GUIDValue2 . ServiceInstance.Name = ServiceInstanceName             07:30:39:>> ConnectionHelper.GetServerInstance: Create 'AuthorizationClient' instance using ConnectionContext             07:30:39:>> AuthorizationBase.RegisterObject: Validate Parent             07:30:39:>> AuthorizationBase.Execute: Logged Error: Failed: System.Exception: Item 'GUIDValue1' does not exist    at SourceCode.Install.Package.Actions.Authorization.AuthorizationBase.RegisterObject(String name, Guid id, Guid parentID, Guid classID, String className, Boolean inherit, Boolean propagate, IIdentityReferenc...
Read more