Azure AD aggregation issue - processReadRequest nullpointer exception

IdentityIQ (IIQ)
1

We’re having this strange behavior and I don’t know if this is a connector/iiq issue or a Azure Graph API limit.
When trying to aggregate from our production Azure AD with 96k+ accounts, we are getting an error when we get to 10,500, always, if we manage to get past that number, the aggregation slows to a crawl, one or two accounts every 10 mins or so
This happens in a single host or if we try to partition. We already did all the recommended things found here, like removing the userIdentities field in the schema, we have tripled checked the permissions in Azure
These are the errors we’re getting

Single host:
Exception during aggregation. Reason: java.lang.RuntimeException: Failed to Aggregate Exception occurred in processReadRequest. Error - java.lang.NullPointerException

Partition:
An error occurred while attempting to create task partitions for Application: Failed to Aggregate Exception occurred in processReadRequest. Error - java.lang.NullPointerException,Azure AD.

Any ideas?

1 Like
2

Ran into this issue on 8.1p3. I am assuming there are other versions that have this issue as well.

The fix from our SailPoint support case was to remove the userIdentities attribute from the account schema.

EDIT: Sorry I didn’t read through your whole post, lol. Looks like you already tried this. Sorry. You could also try removing the risk* attributes. I know those are newer attributes as well and maybe they are causing an issue.

3

Thank you, yes, those are also gone (although that one is fixed adding some extra permissions), the issue seems to be hitting this 10k limit, I’m having a meeting tomorrow with some people that know more about Azure, if there’s something on the Azure side I’ll bring it here, thanks again

1 Like
4

After some time, we couldn’t figure out what the problem is, but the way we were able to solve it, was adding filter partitions, inside the application definition we added this

<entry key="userPartitions">
        <value>
          <List>
            <String>startswith(displayName,'.') or startswith(displayName,'--') or startswith(displayName,'1') or startswith(displayName,'2') or startswith(displayName,'3') 
            or startswith(displayName,'4') or startswith(displayName,'5') or startswith(displayName,'6') or startswith(displayName,'7') or startswith(displayName,'8') 
            or startswith(displayName,'9') or startswith(displayName,'0')</String>
            <String>startswith(displayName,'A')</String>
            <String>startswith(displayName,'B')</String>
            <String>startswith(displayName,'C')</String>
            <String>startswith(displayName,'D')</String>
            <String>startswith(displayName,'E')</String>
            <String>startswith(displayName,'F')</String>
            <String>startswith(displayName,'G')</String>
            <String>startswith(displayName,'H')</String>
            <String>startswith(displayName,'I')</String>
            <String>startswith(displayName,'J')</String>
            <String>startswith(displayName,'K')</String>
            <String>startswith(displayName,'L')</String>
            <String>startswith(displayName,'M')</String>
            <String>startswith(displayName,'N')</String>
            <String>startswith(displayName,'O')</String>
            <String>startswith(displayName,'P')</String>
            <String>startswith(displayName,'Q')</String>
            <String>startswith(displayName,'R')</String>
            <String>startswith(displayName,'S')</String>
            <String>startswith(displayName,'T')</String>
            <String>startswith(displayName,'U')</String>
            <String>startswith(displayName,'V')</String>
            <String>startswith(displayName,'W')</String>
            <String>startswith(displayName,'X')</String>
            <String>startswith(displayName,'Y')</String>
            <String>startswith(displayName,'Z')</String>
          </List>
        </value>
      </entry>

This works so far

1 Like