This issue is caused by having a user created in OneClick with a different case sensitivity, for example; SpecAdmin and specadmin. When the original user (SpecAdmin) is removed from OneClick, it is not removed from the oc_user table in the MySQL Reporting (SRM) database because OneClick is case sensitive but CABI/JasperServer is not, thus CABI treats SpecAdmin and specadmin as the same user and when SpecAdmin is removed from the OneClick user list, it is not removed from the Reporting database oc_user table.
Release : 10.x
Component : Spectrum Reporting
OneClick security sees that SpecAdmin and specadmin are different users and thus the security strings are removed.
The solution is to ensure that there are no duplicate users in OneClick and to delete all instances of this user, so using the previous example - SpecAdmin, specadmin, SPECADMIN, etc.. Once this has been done, the users will be marked for deletion and within an hour they should no longer exist in the MYSQL oc_user table.