Error 303 - Object is in use - Unable to delete domain

The Issue

Attempting to delete a domain on the Administration Console;

 However, the following error appears:

This usually means the domain is still tied to something else, for example, a realm, a policy, a role, etc

Search the Admin Console for Domain Bindings

The first thing to do is check the obvious places on the Admin Console

Authentication > Realms

Check under the domains column...

If you see it in there (as per the example above), edit the realm and remove it.

Administration>Policies

Check all domain/group/user policies that you may have created or edited recently

Administration>Roles

Check if any roles are tied to a domain

Also, check the permissions of all roles in case the domain is specified as the scope

Configuration>Gateways

Check to see if you can see the domain bound to any message gateway

If you see the domain you wish to delete listed in any of the above place then you will need to edit and remove those associations, then try deleting the domain again.

If however, you cannot find it in any of those locations, then it will need to be manually removed using a series of SQL queries.

Force delete (only available from version 8.0.6 upwards)

When you attempt to delete a domain, you will see a dialogue box asking to confirm.

Notice by default the Force delete option is disabled.   If you click Yes at this stage and you get the 303:Object in use error please try and look for the domain bindings as mentioned above. 

If you really cannot find them, or you still get the error even after removing the ones that you can see, then attempt to delete the domain again.

Enable the option to force delete:

 Take note of the yellow warning, and if you are happy, click Yes

Remove using SQL Queries (older versions of DualShield)

Go to Platform>Database Servers  then click on the blue SQL Console button on the top right.

Obtain the ID of the domain you wish to delete:

select id from domain where name =  'spt.deepnetid.com'

In the example above the domain is called spt.deepnetid.com.  Please replace this with the name of your own domain.

Execute the query

In the result we see the id = 5.  For future reference, this will be referred to as the domain_id

Try and delete the domain by executing the following query:

delete from domain where name =  'spt.deepnetid.com'

For future reference, this will be referred to as the first query

You will now see an error which should give details as to why the domain cannot be deleted... for example...

This error tells us that a foreign key constraint fails where the domain_id is referenced in the table role_domain

So we can use the following delete query.  (Remember domain_id = 5)

delete from role_domain where domain_id = 5

Hopefully, you will see 1 row affected, which means that the query has executed correctly and the reference to the domain has been deleted from this table

Run the first query again.

This error tells us that a foreign key constraint fails where the domain_id is referenced in the table usergroup

delete from usergroup where domain_id = 5

Unfortunately, that query returns the following error...

...because there is a row in ldap_group that is referencing the id in a row of the usergroup table we need to delete.  Therefor that row in the ldap_group table needs to be deleted first.

Only the usergroup table contains the column domain_id; therefore the only way to delete the related row in ldap_group is  by matching it to where the  domain_id = 5 in the usergroup table via a join query:

DELETE lg FROM ldap_group lg
JOIN usergroup ug ON lg.id = ug.id
WHERE ug.domain_id = 5;

Once the above query has been executed successfully, can you then run..

delete from usergroup where domain_id = 5

However, that may not be the end because there may be another table referencing rows on usergroup

Here you can use the same join query as above hiowever changing the table name in the first line to match the table name stated in the error above (tbl_policy), and make sure the column name on the second line is changed to group_id

DELETE tp FROM tbl_policy tp
JOIN usergroup ug ON tp.group_id = ug.id
WHERE ug.domain_id = 5;

If you then encounter a third level key constraint issue such as 

Cannot delete or update a parent row: a foreign key constraint fails (`dualshield`.`tbl_policy_applications`, CONSTRAINT `FK61B4ED0FB3470AD4` FOREIGN KEY (`policy_id`) REFERENCES `tbl_policy` (`id`) ON DELETE RESTRICT ON UPDATE RESTRICT) 

Then you need to run a query that links all three tables together to find and delete the applications tied to the policies that belong to domain_id 5:

DELETE tpa FROM tbl_policy_applications tpa
JOIN tbl_policy tp ON tpa.policy_id = tp.id
JOIN usergroup ug ON tp.group_id = ug.id
WHERE ug.domain_id = 5;

If successful, you need to then run the previous query (DELETE tp FROM tbl_policy tp...)  followed by the query before that (delete from usergroup...) until you get back to the first query (delete from domain where name = ...)

You need to follow the pattern above until the first query to delete the domain executes successfully.