How To Fix RS2HANA_AUTH111 - Cannot delete obsolete roles automatically

SAP Error Message - Details

• Message type: E = Error

• Message class: RS2HANA_AUTH -

• Message number: 111

• Message text: Cannot delete obsolete roles automatically

What causes this issue?

Some roles have been found which are not required anymore based on the
given authorizations or because of the direct assignment of privileges
and procedures to the users. As the SAPSID user does not have the ROLE
ADMIN privilege, the roles cannot be deleted automatically by the SAP
HANA model generation framework.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

If you want the roles to be deleted in the system, log on to your SAP
HANA system and search for all roles starting with the prefix bw2hana/
<SAPSID>. These roles were generated by the SAP HAHA model generation
framework and are not required anymore, meaning that they can be
deleted.
This is not mandatory. The functionality of SAP HANA model generation is
not impacted if the roles are not deleted.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message RS2HANA_AUTH111 - Cannot delete obsolete roles automatically ?

  The SAP error message RS2HANA_AUTH111 indicates that the system is unable to automatically delete obsolete roles in the context of SAP HANA. This typically occurs during the process of managing authorizations and roles in the SAP system, particularly when transitioning to or managing a HANA database.
  Cause:
  The error can be caused by several factors, including:
  
  Role Dependencies: The roles that are marked as obsolete may still have dependencies or assignments that prevent their deletion.
  Authorization Issues: The user executing the deletion may not have the necessary authorizations to delete the roles.
  Technical Issues: There may be technical issues or inconsistencies in the role management tables or the system configuration.
  Custom Roles: Custom roles that are not properly configured or are linked to other objects may also lead to this error.
  
  Solution:
  To resolve the RS2HANA_AUTH111 error, you can follow these steps:
  
  
  Check Role Assignments:
  
  Verify if the roles marked as obsolete are still assigned to any users or other roles. If they are, you will need to remove those assignments before attempting to delete the roles.
  
  
  
  Review Authorizations:
  
  Ensure that the user attempting to delete the roles has the necessary authorizations. You may need to consult with your security team to grant the appropriate permissions.
  
  
  
  Manual Deletion:
  
  If automatic deletion fails, you can try to delete the roles manually through the SAP GUI. Navigate to the role management transaction (e.g., PFCG) and attempt to delete the roles directly.
  
  
  
  Check for Technical Issues:
  
  Look for any inconsistencies in the role management tables. You may need to run consistency checks or consult SAP support for assistance if you suspect a technical issue.
  
  
  
  Consult SAP Notes:
  
  Check the SAP Support Portal for any relevant SAP Notes that may address this specific error. There may be patches or updates that can resolve the issue.
  
  
  
  System Logs:
  
  Review system logs for any additional error messages or warnings that may provide more context about why the deletion is failing.
  
  
  
  Related Information:
  
  SAP Documentation: Refer to the official SAP documentation for role management and authorization concepts in SAP HANA.
  SAP Community: Engage with the SAP Community forums to see if other users have encountered similar issues and what solutions they have found.
  SAP Support: If the issue persists, consider opening a support ticket with SAP for further assistance.
  
  By following these steps, you should be able to identify the cause of the RS2HANA_AUTH111 error and implement a solution to resolve it.