Java 17 module access restriction

We are using SailPoint IdentityIQ with a Web Services connector and an After Rule that parses an XML response returned by the target system.

This logic was working correctly when IdentityIQ was running on Java 11, but after upgrading the runtime to Java 17, aggregation now fails with an exception related to DocumentBuilderFactory.

Exception during aggregation of Object Type Group on Application iBusiness-API.
Reason: java.lang.RuntimeException: sailpoint.connector.ConnectorException:
Error: BeanShell script error:

bsh.EvalError: Typed variable declaration :
Error in method invocation:
Cannot access method newDocumentBuilder() in
class com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl

java.lang.IllegalAccessException:
class bsh.Reflect cannot access
class com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl
(in module java.xml) because module java.xml does not export
com.sun.org.apache.xerces.internal.jaxp to unnamed module

and the script is

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;

import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;

import java.io.ByteArrayInputStream;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

Log log = LogFactory.getLog(“xyz.ParseUserTemplates.AfterRule”);

Map updatedMapInfo = new HashMap();

if (rawResponseObject != null) {

String cleanedResponse = rawResponseObject
    .replace("", "a")
    .replace("&", "a")
    .replace("
", "a");

try {

    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    factory.setNamespaceAware(true);

    DocumentBuilder builder = factory.newDocumentBuilder();
    Document document = builder.parse(
        new ByteArrayInputStream(
            cleanedResponse.getBytes(StandardCharsets.UTF_8)
        )
    );

    NodeList userTemplateNodes = document.getElementsByTagName("UserTemplate");
    List<Map> schemaDataList = new ArrayList();

    for (int i = 0; i < userTemplateNodes.getLength(); i++) {

        Node userTemplateNode = userTemplateNodes.item(i);
        NodeList childNodes = userTemplateNode.getChildNodes();

        String id = null;
        String name = null;

        for (int j = 0; j < childNodes.getLength(); j++) {

            Node child = childNodes.item(j);

            if (child.getNodeType() == Node.ELEMENT_NODE) {

                String nodeName = child.getLocalName();

                if ("ID".equals(nodeName)) {
                    id = child.getTextContent();
                } else if ("Name".equals(nodeName)) {
                    name = child.getTextContent();
                }
            }
        }

        if (id != null && name != null) {
            Map entry = new HashMap();
            entry.put("ID", id);
            entry.put("Name", name);
            schemaDataList.add(entry);
        }
    }

    updatedMapInfo.put("data", schemaDataList);
    return updatedMapInfo;

} catch (Exception e) {
    log.error("Error parsing XML document", e);
}

} else {
log.warn(“Raw response object is null”);
}

return updatedMapInfo;

Hello, how are you running the application server using startup.bat or as a Windows service?

Copy/paste reply (Windows-focused + clear steps):

Hi @pradeepireddy_123

This is not an XML parsing regression. It’s a Java 17 module-access restriction hitting BeanShell.

Your error says it all:

  • module java.xml does not export com.sun.org.apache.xerces.internal.jaxp to unnamed module

  • and BeanShell (bsh.Reflect) can’t call newDocumentBuilder() on the JDK’s internal Xerces class.

Add one JVM flag to Tomcat (Windows), restart Tomcat

1) Add the JVM option (Windows / Tomcat service)

  1. Go to your Tomcat bin folder.

  2. Open Tomcat Monitor / Configure Tomcat:

    • If Tomcat is installed as a service, run tomcat9w.exe (or tomcat8w.exe depending on your version).
  3. Go to the Java tab.

  4. Under Java Options, add this line (exactly):

--add-opens=java.xml/com.sun.org.apache.xerces.internal.jaxp=ALL-UNNAMED

  1. Click Apply.

  2. Restart the Tomcat service.

2) If it still fails (add the export too)

Add this second line as well (keep the first one too):

--add-exports=java.xml/com.sun.org.apache.xerces.internal.jaxp=ALL-UNNAMED

Restart Tomcat again.

3) If you are NOT running Tomcat as a Windows service

If you start Tomcat from startup.bat, then add the option in:

<TOMCAT_HOME>\bin\setenv.bat (create it if it doesn’t exist)

Example:

set "CATALINA_OPTS=%CATALINA_OPTS% --add-opens=java.xml/com.sun.org.apache.xerces.internal.jaxp=ALL-UNNAMED"

(And if needed, add the --add-exports line the same way.)

Then restart Tomcat.

References you may need to check further

Hi @pradeepireddy_123 Please my reply resolution to your issue if it fixed it or not let is know please

Hi @amrdodani It did worked but what if we move to Identity security Cloud.