Pete's Log: External Content Type Failed to Save - The Name cannot be resolved via Active Directory

Entry #2640, (Coding, Hacking, & CS stuff, Work)
(posted when I was 46 years old.)

Yet again, Pete finds himself mucking around directly in a SharePoint database. Don't try this at home.

At some point, somebody (not me) directly granted some consultants read access to some of our external content types. There's an "All Users" group that already has access, but these consultants weren't in that group. Eventually those consultants left and their accounts got deleted, but their permissions remained. And now when I tried updating the external content type, I got an error.

External Content Type Failed to Save The name domain\username cannot be resolved via Active Directory An error occurred in Business Data Connectivity

The permissions UI does not show the deleted users, but I did try resaving in the UI, with no luck.

The solution that worked for me was to delete the permission directly in the BDC database. Anything involving mucking around in a SharePoint database is unsupported, so proceed at your own risk. But this did work for me in SharePoint 2019.

The permissions are stored in the AR_MetadataObjectSecurity table. The user/group is in the IdentityName column. It's stored in claims format, so something like i:0#.w|domain\username. Find the rows with the deleted user and delete them. After I did that, I was able to save my external content type.

When I searched for the error online, I found one forum post asking about it (with no answers) and several results on Microsoft sites, which all 404'd when I clicked them. So hence this post.

My recommendation, though, would be to only grant BDC permissions via groups, so that deleted users don't cause this problem in the first place.