diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java b/security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java
index bb68e32..ff8e2ba 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java
@@ -20,6 +20,7 @@
 package org.apache.ranger.biz;
 
 import java.util.HashSet;
+import java.util.List;
 import java.util.Set;
 
 import org.apache.commons.collections.CollectionUtils;
@@ -29,6 +30,7 @@
 import org.apache.ranger.common.MessageEnums;
 import org.apache.ranger.common.RESTErrorUtil;
 import org.apache.ranger.common.RangerCommonEnums;
+import org.apache.ranger.common.db.RangerTransactionSynchronizationAdapter;
 import org.apache.ranger.db.RangerDaoManager;
 import org.apache.ranger.db.XXRoleRefGroupDao;
 import org.apache.ranger.db.XXRoleRefRoleDao;
@@ -38,13 +40,14 @@
 import org.apache.ranger.entity.XXRoleRefGroup;
 import org.apache.ranger.entity.XXRoleRefRole;
 import org.apache.ranger.entity.XXRoleRefUser;
+import org.apache.ranger.entity.XXTrxLog;
 import org.apache.ranger.entity.XXUser;
 import org.apache.ranger.plugin.model.RangerRole;
 import org.apache.ranger.service.RangerAuditFields;
+import org.apache.ranger.service.RangerTransactionService;
 import org.apache.ranger.service.XGroupService;
 import org.apache.ranger.service.XUserService;
 import org.apache.ranger.view.VXGroup;
-import org.apache.ranger.view.VXUser;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
@@ -71,6 +74,15 @@
     @Autowired
     XGroupService xGroupService;
 
+    @Autowired
+    RangerTransactionSynchronizationAdapter rangerTransactionSynchronizationAdapter;
+
+	@Autowired
+	RangerTransactionService transactionService;
+
+	@Autowired
+	RangerBizUtil xaBizUtil;
+
 	public void createNewRoleMappingForRefTable(RangerRole rangerRole, Boolean createNonExistUserGroup) throws Exception {
 		if (rangerRole == null) {
 			return;
@@ -99,29 +111,40 @@
 				if (StringUtils.isBlank(roleUser)) {
 					continue;
 				}
-				VXUser vXUser = null;
+				Long userId = null;
 				XXUser xUser = daoMgr.getXXUser().findByUserName(roleUser);
 
 				if (xUser == null) {
 					if (createNonExistUserGroup) {
 						LOG.warn("User specified in role does not exist in ranger admin, creating new user, User = "
 								+ roleUser);
-						vXUser = xUserMgr.createExternalUser(roleUser);
+						// Schedule another transaction and let this transaction complete (and commit) successfully!
+						final RoleUserCreateContext roleUserCreateContext = new RoleUserCreateContext(roleUser, roleId);
+						Runnable CreateAndAssociateUser = new Runnable () {
+							@Override
+							public void run() {
+								Runnable realTask = new Runnable () {
+									@Override
+									public void run() {
+										doCreateAndAssociateRoleUser(roleUserCreateContext);
+									}
+								};
+								transactionService.scheduleToExecuteInOwnTransaction(realTask, 0L);
+							}
+                        };
+						rangerTransactionSynchronizationAdapter.executeOnTransactionCommit(CreateAndAssociateUser);
+
 					} else {
 						throw restErrorUtil.createRESTException("user with name: " + roleUser + " does not exist ",
 								MessageEnums.INVALID_INPUT_DATA);
 					}
 				}else {
-					 vXUser = xUserService.populateViewBean(xUser);
+					userId = xUser.getId();
 				}
 
-				XXRoleRefUser xRoleRefUser = rangerAuditFields.populateAuditFieldsForCreate(new XXRoleRefUser());
-
-				xRoleRefUser.setRoleId(roleId);
-				xRoleRefUser.setUserId(vXUser.getId());
-				xRoleRefUser.setUserName(roleUser);
-				xRoleRefUser.setUserType(0);
-				daoMgr.getXXRoleRefUser().create(xRoleRefUser);
+				if(null != userId) {
+					userRoleAssociation(roleId,userId,roleUser);
+				}
 			}
 		}
 
@@ -131,7 +154,7 @@
 				if (StringUtils.isBlank(roleGroup)) {
 					continue;
 				}
-				VXGroup vXGroup = null;
+				Long groupId = null;
 				XXGroup xGroup = daoMgr.getXXGroup().findByGroupName(roleGroup);
 
 				if (xGroup == null) {
@@ -140,23 +163,36 @@
 								+ roleGroup);
 						VXGroup vxGroupNew = new VXGroup();
 						vxGroupNew.setName(roleGroup);
+						vxGroupNew.setDescription(roleGroup);
 						vxGroupNew.setGroupSource(RangerCommonEnums.GROUP_EXTERNAL);
-						vXGroup = xUserMgr.createXGroup(vxGroupNew);
+						// Schedule another transaction and let this transaction complete (and commit) successfully!
+						final RoleGroupCreateContext roleGroupCreateContext = new RoleGroupCreateContext(vxGroupNew, roleId);
+
+						Runnable createAndAssociateRoleGroup = new Runnable() {
+                            @Override
+                            public void run() {
+                                Runnable realTask = new Runnable() {
+                                    @Override
+                                    public void run() {
+                                        doCreateAndAssociateRoleGroup(roleGroupCreateContext);
+                                    }
+                                };
+                                transactionService.scheduleToExecuteInOwnTransaction(realTask, 0L);
+                            }
+                        };
+						rangerTransactionSynchronizationAdapter.executeOnTransactionCommit(createAndAssociateRoleGroup);
+
 					} else {
 						throw restErrorUtil.createRESTException("group with name: " + roleGroup + " does not exist ",
 								MessageEnums.INVALID_INPUT_DATA);
 					}
 				}else {
-					vXGroup = xGroupService.populateViewBean(xGroup);
+					groupId = xGroup.getId();
 				}
 
-				XXRoleRefGroup xRoleRefGroup = rangerAuditFields.populateAuditFieldsForCreate(new XXRoleRefGroup());
-
-				xRoleRefGroup.setRoleId(roleId);
-				xRoleRefGroup.setGroupId(vXGroup.getId());
-				xRoleRefGroup.setGroupName(roleGroup);
-				xRoleRefGroup.setGroupType(0);
-				daoMgr.getXXRoleRefGroup().create(xRoleRefGroup);
+				if(null != groupId) {
+					groupRoleAssociation(roleId, groupId, roleGroup);
+				}
 			}
 		}
 
@@ -210,4 +246,174 @@
 		}
 		return true;
 	}
+
+	public void groupRoleAssociation(Long roleId, Long groupId, String groupName) {
+		if(LOG.isDebugEnabled()) {
+			LOG.debug("===> groupRoleAssociation()");
+		}
+
+		XXRoleRefGroup xRoleRefGroup = rangerAuditFields.populateAuditFieldsForCreate(new XXRoleRefGroup());
+		xRoleRefGroup.setRoleId(roleId);
+		xRoleRefGroup.setGroupId(groupId);
+		xRoleRefGroup.setGroupName(groupName);
+		xRoleRefGroup.setGroupType(0);
+		daoMgr.getXXRoleRefGroup().create(xRoleRefGroup);
+	}
+
+	private static final class RoleGroupCreateContext {
+		final VXGroup group;
+		final Long roleId;
+
+		RoleGroupCreateContext(VXGroup group, Long roleId) {
+			this.group = group;
+			this.roleId = roleId;
+		}
+
+		@Override
+		public String toString() {
+			return "{group=" + group + ", roleId=" + roleId + "}";
+		}
+	}
+
+	void doCreateAndAssociateRoleGroup(final RoleGroupCreateContext context) {
+		if (LOG.isDebugEnabled()) {
+			LOG.debug("===> doCreateAndAssociateRoleGroup()");
+		}
+		XXGroup xGroup = daoMgr.getXXGroup().findByGroupName(context.group.getName());
+
+		if (xGroup != null) {
+			groupRoleAssociation(context.roleId, xGroup.getId(), context.group.getName());
+		} else {
+			try {
+				// Create group
+				VXGroup vXGroup = xGroupService.createXGroupWithOutLogin(context.group);
+				if (null != vXGroup) {
+					List<XXTrxLog> trxLogList = xGroupService.getTransactionLog(vXGroup, "create");
+					xaBizUtil.createTrxLog(trxLogList);
+				}
+			} catch (Exception exception) {
+				LOG.error("Failed to create Group or to associate group and role, RoleGroupContext:[" + context + "]",
+						exception);
+			} finally {
+				// This transaction may still fail at commit time because another transaction
+				// has already created the group
+				// So, associate the group to role in a different transaction
+				Runnable associateRoleGroup = new Runnable() {
+                    @Override
+					public void run() {
+						Runnable realTask = new Runnable() {
+							@Override
+							public void run() {
+								doAssociateRoleGroup(context);
+							}
+						};
+						transactionService.scheduleToExecuteInOwnTransaction(realTask, 0L);
+					}
+                };
+				rangerTransactionSynchronizationAdapter.executeOnTransactionCompletion(associateRoleGroup);
+			}
+		}
+	}
+
+	void doAssociateRoleGroup(final RoleGroupCreateContext context) {
+		if(LOG.isDebugEnabled()) {
+			LOG.debug("===> doAssociateRoleGroup()");
+		}
+		XXGroup xGroup = daoMgr.getXXGroup().findByGroupName(context.group.getName());
+
+		if (xGroup == null) {
+			LOG.error("No Group created!! Irrecoverable error! RoleGroupContext:[" + context + "]");
+		} else {
+			try {
+				groupRoleAssociation(context.roleId, xGroup.getId(), context.group.getName());
+			} catch (Exception exception) {
+				LOG.error("Failed to associate group and role, RoleGroupContext:[" + context + "]", exception);
+			}
+		}
+	}
+
+	private static final class RoleUserCreateContext {
+		final String userName;
+		final Long roleId;
+
+		RoleUserCreateContext(String userName, Long roleId) {
+			this.userName = userName;
+			this.roleId = roleId;
+		}
+
+		@Override
+		public String toString() {
+			return "{userName=" + userName + ", roleId=" + roleId + "}";
+		}
+	}
+
+	public void userRoleAssociation(Long roleId, Long userId, String userName) {
+		if(LOG.isDebugEnabled()) {
+			LOG.debug("===> userRoleAssociation()");
+		}
+		XXRoleRefUser xRoleRefUser = rangerAuditFields.populateAuditFieldsForCreate(new XXRoleRefUser());
+		xRoleRefUser.setRoleId(roleId);
+		xRoleRefUser.setUserId(userId);
+		xRoleRefUser.setUserName(userName);
+		xRoleRefUser.setUserType(0);
+		daoMgr.getXXRoleRefUser().create(xRoleRefUser);
+		if(LOG.isDebugEnabled()) {
+			LOG.debug("<=== userRoleAssociation()");
+		}
+	}
+
+	void doCreateAndAssociateRoleUser(final RoleUserCreateContext context) {
+		if (LOG.isDebugEnabled()) {
+			LOG.debug("===> doCreateAndAssociateRoleUser()");
+		}
+		XXUser xUser = daoMgr.getXXUser().findByUserName(context.userName);
+
+		if (xUser != null) {
+			userRoleAssociation(context.roleId, xUser.getId(), context.userName);
+		} else {
+			try {
+				// Create External user
+				xUserMgr.createServiceConfigUser(context.userName);
+			} catch (Exception exception) {
+				LOG.error("Failed to create User or to associate user and role, RoleUserContext:[" + context + "]",
+						exception);
+			} finally {
+				// This transaction may still fail at commit time because another transaction
+				// has already created the user
+				// So, associate the user to role in a different transaction
+				Runnable associateRoleUser = new Runnable() {
+					@Override
+					public void run() {
+						Runnable realTask = new Runnable() {
+							@Override
+							public void run() {
+								doAssociateRoleUser(context);
+							}
+						};
+						transactionService.scheduleToExecuteInOwnTransaction(realTask, 0L);
+					}
+                };
+				rangerTransactionSynchronizationAdapter.executeOnTransactionCompletion(associateRoleUser);
+			}
+		}
+
+	}
+
+	void doAssociateRoleUser(final RoleUserCreateContext context) {
+		if(LOG.isDebugEnabled()) {
+			LOG.debug("===> doAssociateRoleUser()");
+		}
+		XXUser xUser = daoMgr.getXXUser().findByUserName(context.userName);
+
+		if (xUser == null) {
+			LOG.error("No User created!! Irrecoverable error! RoleUserContext:[" + context + "]");
+		} else {
+			try {
+				userRoleAssociation(context.roleId, xUser.getId(), context.userName);
+			} catch (Exception exception) {
+				LOG.error("Failed to associate user and role, RoleUserContext:[" + context + "]", exception);
+			}
+		}
+	}
+
 }