Identity: Cannot delete Group Alias after associated Group is deleted

[solmonk]

Environment:

• Vault Version: 0.9.1

Expected Behavior:

After deleting a group, the associated group alias is also deleted.

Actual Behavior:

If I delete a group first, the associated group alias is not deleted, and there is no way to delete it.

Steps to Reproduce:

Just associated a group with an alias and tried to delete the group first.

$ ./vault write identity/group policies=admin type=external
Key     Value
---     -----
id      9334d0f7-d111-4bb2-21c0-31245493f388
name    group_77c9848b

$ ./vault write identity/group-alias mount_accessor=auth_github_4ae7ab8d name=admin canonical_id=9334d0f7-d111-4bb2-21c0-31245493f388
Key             Value
---             -----
canonical_id    9334d0f7-d111-4bb2-21c0-31245493f388
id              3f82d666-57a9-5095-2faa-f6cf16c81fa7

$ ./vault delete identity/group/id/9334d0f7-d111-4bb2-21c0-31245493f388
Success! Data deleted (if it existed) at: identity/group/id/9334d0f7-d111-4bb2-21c0-31245493f388

$ ./vault delete identity/group-alias/id/3f82d666-57a9-5095-2faa-f6cf16c81fa7
Error deleting identity/group-alias/id/3f82d666-57a9-5095-2faa-f6cf16c81fa7: Error making API request.

URL: DELETE https://vault.alpha.devsisters.cloud/v1/identity/group-alias/id/3f82d666-57a9-5095-2faa-f6cf16c81fa7
Code: 500. Errors:

* 1 error occurred:

* alias not associated to a group

Is this an intended behavior? I found out that after deleting an entity, the associated entity aliases are successfully deleted, so the problem only exists for groups.

[solmonk]

Thanks for the quick fix! Although the issue will be resolved, is there any possible way to remove already orphaned group aliases?

[vishalnayak]

@solmonk The group aliases are persisted as part of the group itself. So, when the group gets deleted, any persistent information regarding the group aliases also get deleted. The fix in this PR is to delete the group alias entry from the in-memory database. If you restart the server, the in-memory database gets repopulated with only those groups and aliases that are in the storage.

[solmonk]

Thanks again for the kind explanation! :)