Identity Processing Error: StaticTransform cannot be cast to class java.util.ArrayList

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Full error message shown on identity of all new employees:
trackingId: f3e3bfded86d432a813b3438c949c6ce java.lang.RuntimeException: sailpoint.tools.GeneralException: class com.sailpoint.seaspray.transform.StaticTransform cannot be cast to class java.util.ArrayList (com.sailpoint.seaspray.transform.StaticTransform is in unnamed module of loader ‘app’; java.util.ArrayList is in module java.base of loader ‘bootstrap’)

Hi! Newbie here.
This is the first set of new employee accounts uploaded into the Authoritative (HR) Source since I enabled the Lifecycle Provisioning and Active Directory Account Provisioning Policy.

I was expecting to see three things: (1) the Authoritative Source account created with account status = enabled or disabled based on employment status as defined in the Lifecycle provisioning policy (success), (2) an Identity Profile created with identity state = active, lifecycle state = prestart or active, and all attributes correctly displayed (success with above error message), and finally (3) an Active Directory account created (failure, no error/no attempt made).

Unfortunately, since I’ve made so many changes since the last new employee was uploaded, I have no idea where to look to fix the error message. At first, I was seeing other error messages too, but those were much easier to decipher what they were referencing and I fixed them quickly. For this one, I thought it was a specific entry in my AD provisioning policy, so I modified it to a different transform type (concat instead of static), but this did not change the error message after an identity profile refresh and source aggregation.

2

Hi @Shaebates,

Welcome to the Sailpoint developper community !

I think in your identity profiles you are one transform using transform type “static” that cause this issue.

Can you provide here your different transforms that use static ?

If those transform contain sensitive information please remove them before share them.

Best regards.

1 Like
3

Hi @Shaebates,

Can you post your transform here
Which you have used in provisioning policy?

-Vasanth

4

I have three static transforms in the provisioning policy:

#This one was in the list by default and I didn’t touch it. Maybe it’s not needed?

  {
            "name": "ObjectType",
            "transform": {
                "type": "static",
                "attributes": {
                    "value": "User"
                }
            },
            "attributes": {
                "cloudRequired": "true"
            },
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        },

#This is the one I thought it was complaining about that I said I tried changing to concat (samaccountname is defined higher in the policy):

{
            "name": "distinguishedName",
            "transform": {
                "type": "static",
                "attributes": {
                    "value": "CN=${sAMAccountName},OU=Sailpoint_QA,OU=Users,OU=Company Name,DC=name,DC=corp,DC=com"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        },

#Third one, nothing special

        {
            "name": "msExchHideFromAddressLists",
            "transform": {
                "type": "static",
                "attributes": {
                    "value": "false"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "boolean",
            "isMultiValued": false
        },

Thanks @vasanthrajsp29 and @baoussounda

5

I just tested removing each of those transforms individually and then re-processing one of the identities that has the error. After all 3 were removed, I am still seeing the same error.

I am now looking at the Identity Profile, which was entirely built using the UI, except for a few account transforms. None of this data has any “static” type transforms.

6

Hi @Shaebates ,

Want to know where actually you are seeing this error? In “identities with error” tab?? or in the search tab while provisioning AD account?

image
image333×220 6.35 KB

8

Hi @Shaebates,

Instead of adding transform you may try to add UI.
Like this below.

image (12)
image (12)882×311 7.08 KB

Issue is with Provisioning Policy Transform not with Identity Profile Transform please use static values in UI.

-Vasanth

9

Hi @Shaebates

Your issue came from your identity profile, please share any transform that use static that you’re in your identity profile.

This transform can be any another type but use static inside on it.

10

Identities with error tab, like your screenshot. There’s a little ! next to the identity with a tooltip that says Processing Error and if I click on it, a pop-up shows me the error message.

11

Ok, thank you, I did move that one to UI now.

To know if it worked, would I need to re-aggregate a source or re-process the identity?

UI static
UI static1295×873 107 KB

12

I don’t have any static transforms in the mappings tab on the Identity Profile, or in any of the custom transforms I made for that policy.

1 Like
13

@Shaebates thiking you say that all of your new employee (new created idenity) are in error.

14

Hi @Shaebates,

I’ve one more doubt here What is the Custom Transform logic you’ve used for calculating sAMAccountName, Please provide this Custom Transform.

Are you able to create accounts earlier (before configuring those 3 transforms which you mentioned above)?

15

On this screen, if I click Export, I get a csv that says the error is missing email.

image
image681×110 3.59 KB

I do have a transform for that field:

{
    "id": "45143caf-ca65-46d2-81bc-66b6996aa949",
    "name": "Identity Null Email",
    "type": "firstValid",
    "attributes": {
        "values": [
            {
                "attributes": {
                    "sourceName": "Active Directory",
                    "attributeName": "mail"
                },
                "type": "accountAttribute"
            },
            {
                "attributes": {
                    "sourceName": "Dayforce Sandbox",
                    "attributeName": "Federated ID"
                },
                "type": "accountAttribute"
            },
            "[email protected]"
        ],
        "ignoreErrors": false
    },
    "internal": false
}

I copy/pasted that from the solution on a different topic in this forum. They said that the email address doesn’t have to be valid, it just can’t be null. When I click on the Identity, it does show the fake email, so I’m not sure why it says its missing in the CSV.

After that, I searched for the Identity in VSCode and see this:

    "id": "36a86519f437413fa6579cbeb71f2087",
    "name": "Scott, Michael",
    "displayName": "Michael Scott",
    "firstName": "Michael",
    "lastName": "Scott",
    "email": "[email protected]",
    "created": "2024-12-19T23:22:54.049Z",
    "modified": "2024-12-19T23:23:58.267Z",
    "inactive": false,
    "protected": false,
    "status": "ERROR",

.....

    "attributes": {
        "triggerSnapshots": "{AttributeChange={firstname=Michael, cloudStatus=UNREGISTERED, displayName=Michael Scott, title=Assistant Controller, identityState=ACTIVE, lastname=Scott, uid=Michael-Scott-701042, cloudAuthoritativeSource=58b13592d60143d18d4a222395d629f3, internalCloudStatus=UNREGISTERED, organization=FN, cloudLifecycleState=PRESTART, identificationNumber=701042, location= Ops , department=Accounting, [email protected], startDate=2024-12-18T00:00:00}}",
        "firstname": "Michael",
        "cloudStatus": "ERROR",
        "displayName": "Michael Scott",
        "title": "Assistant Controller",
        "identityState": "ACTIVE",
        "lastname": "Scott",
        "processingState": "ERROR",
        "uid": "Michael-Scott-701042",
        "cloudAuthoritativeSource": "58b13512d60143d29d4a2272393765f3",
        "processingDetails": "{date=Thu Dec 19 23:23:58 GMT 2024, stage=Refresh, retryCount=3, stackTrace=null, message=trackingId: 8070fbafa1fd40edbf921860f980b212 java.lang.RuntimeException: sailpoint.tools.GeneralException: class com.sailpoint.seaspray.transform.StaticTransform cannot be cast to class java.util.ArrayList (com.sailpoint.seaspray.transform.StaticTransform is in unnamed module of loader 'app'; java.util.ArrayList is in module java.base of loader 'bootstrap')}",
        "internalCloudStatus": "UNREGISTERED",

I then tried deleting the Identity and re-aggregating the HR source, but it still got the same error.

16

I had 6 accounts yesterday that HR onboarded to Dayforce (authoritative source). 4 of them were actual new employees and 2 of them were fake with specific values I wanted to test. All 6 had the error. At some point during troubleshooting yesterday, I manually created the AD account for 3 of the real employees and then aggregated AD again. One of the identities correlated to AD and the Processing error disappeared. I manually correlated the second one and then the processing error disappeared.

I don’t know how to interpret what this means as far as where my error is though.

17 
{
            "name": "sAMAccountName",
            "transform": {
                "type": "usernameGenerator",
                "attributes": {
                    "sourceCheck": true,
                    "patterns": "$fi$ln$num{uniqueCounter}",
                    "fi": {
                        "type": "substring",
                        "attributes": {
                            "input": {
                                "type": "identityAttribute",
                                "attributes": {
                                    "name": "firstName"
                                }
                            },
                            "start": 0,
                            "end": 1
                        }
                    },
                    "ln": {
                        "type": "identityAttribute",
                        "attributes": {
                            "name": "lastName"
                        }
                    },
                    "num": {
                        "type": "randomNumeric",
                        "attributes": {
                            "length": "4"
                        }
                    }
                }
            },
            "attributes": {
                "cloudMaxUniqueChecks": "5",
                "cloudMaxSize": "20",
                "cloudRequired": "true"
            },
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        },

It was processing Identities just fine before I developed the AD Provisioning policy.

18

Can you remove mapping for email attribute in identity profile and check?
Also, can you manually try to provision AD account and see if sAMAccount and email are getting generated?

19

If not try this transform

{
    "id": "45143caf-ca65-46d2-81bc-66b6996aa949",
    "name": "Identity Null Email",
    "type": "firstValid",
    "attributes": {
        "values": [
            {
                "attributes": {
                    "sourceName": "Active Directory",
                    "attributeName": "mail"
                },
                "type": "accountAttribute"
            },
            "N/A"
        ],
        "ignoreErrors": false
    },
    "internal": false
}
20

@Shaebates as you can see in error message :

 class com.sailpoint.seaspray.transform.StaticTransform cannot be cast to class java.util.ArrayList 
(com.sailpoint.seaspray.transform.StaticTransform is in unnamed module of loader 'app';java.util.ArrayList is in module java.base of loader 'bootstrap')}",

Seems like you’re try to use array in place string.

When adding the Active Directory Provisioning which mappings do you modify into your identity profile

21

In my AD provisioning, I have created custom transforms for:
sAMAccountName, businessCategory, and each of the Address fields (street, l, st, postalCode).

I already posted sAMAccountName. The others are lookups like this:

            "name": "st",
            "transform": {
                "type": "lookup",
                "attributes": {
                    "input": {
                        "type": "identityAttribute",
                        "attributes": {
                            "name": "location"
                        }
                    },
                    "table": {
                        "Ops": "LA",
                        "Dallas": "TX",
                        "New Orleans": "LA",
                        "default": "LA"
                    }
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        },