Hello SailPoint Support,
We are facing an issue with an Identity Security Cloud transform used to calculate the Lifecycle State for contractor identities.
The transform is a static transform that uses two nested dateCompare transforms. Both dateCompare blocks read the same account attribute from the authoritative source “Terceiros”, attribute “endDate”.
However, during identity refresh, some identities are failing with the following error:
java.lang.IllegalArgumentException: DateCompare failed: both firstDate and secondDate must be provided. Current values: firstDate[null], secondDate[2026-05-01T00:00Z]
The error indicates that firstDate is being resolved as null, even though the transform is configured to read the account attribute Terceiros.endDate.
"type": "static",
"attributes": {
"isActive": {
"type": "dateCompare",
"attributes": {
"firstDate": {
"attributes": {
"sourceName": "Terceiros",
"attributeName": "endDate"
},
"inputFormat": "ISO8601",
"outputFormat": "ISO8601",
"type": "accountAttribute"
},
"secondDate": {
"type": "dateMath",
"attributes": {
"expression": "now-1h",
"roundUp": true
}
},
"operator": "gt",
"positiveCondition": "true",
"negativeCondition": "false"
}
},
"within45DaysAfterEndDate": {
"type": "dateCompare",
"attributes": {
"firstDate": {
"attributes": {
"sourceName": "Terceiros",
"attributeName": "endDate"
},
"inputFormat": "ISO8601",
"outputFormat": "ISO8601",
"type": "accountAttribute"
},
"secondDate": {
"type": "dateMath",
"attributes": {
"expression": "now-45d-1h",
"roundUp": true
}
},
"operator": "gt",
"positiveCondition": "true",
"negativeCondition": "false"
}
},
"value": "#if($isActive == 'true')active#elseif($within45DaysAfterEndDate == 'true')bloqueado#{else}inactive#end",
"requiresPeriodicRefresh": true
},
"internal": false
}
Expected behavior:
-
If Terceiros.endDate is greater than current date/time minus 1 hour:
lifecycleState should be active. -
If Terceiros.endDate is not active anymore, but still within 45 days after the end date:
lifecycleState should be bloqueado. -
If Terceiros.endDate is older than 45 days:
lifecycleState should be inactiveCurrently, the transform works as expected for most identities. However, some identities encounter the reported error during the Identity Refresh process.
We have observed that when the logic related to the “bloqueado” state (the second
dateCompare) is removed and only the “active” and “inactive” states are kept, the transform executes normally and the error does not occur.Have any ideia ?