Version
Carbon Black 5.x.
Issue
When attempting to delete a user from the CB UI, the UI returns a "Unable to delete user" and "An unexpected error occurred - please contact your System Administrator" error.
Symptoms
/var/log/cb/coreservices/debug.log contains the following:
IntegrityError: (IntegrityError) update or delete on table "cb_user" violates foreign key constraint "investigations_created_by_user_id_fkey" on table "investigations" DETAIL: Key (id)=(6) is still referenced from table "investigations".
'DELETE FROM cb_user WHERE cb_user.username = %(username_1)s' {'username_1': u'User1'}
Another similar error is:
<err> cb.flask.api_blueprint - Unhandled exception from API request: (IntegrityError) update or delete on table "cb_user" violates foreign key constraint "banning_blacklist_create_user_id_fkey" on table "banning_blacklist"
DETAIL: Key (id)=(3) is still referenced from table "banning_blacklist".
'DELETE FROM cb_user WHERE cb_user.username = %(username_1)s' {'username_1': u'User1}
where User1 is the user in question.
CauseCarbon Black has integrity controls to prevent customers from deleting users who have active investigations in progress.
Solution
Login as user and review active investigations. If you'd still like to proceed with deleting user, untag events and attempt deletion again.
If all investigation events has been untagged and your error is similar to the 2nd example, this is a limitation on the product, and we suggest submitting a Feature Request for it via the User eXchange.
Internal Notes
