I’m trying to setup Rapid Setup Joiner in my new 8.5 IIQ installation and I’m running into an issue. I’m hoping someone has some pointers to get me through this.
So far, it’s a very very basic config -
In the global settings for Rapid Setup Config, I enabled Joiner processing and turned on Generate approvals.
Joiner business process is set to out of the box RapidSetup - Joiner
I added a simple trigger filter that checks a couple of attributes.
I confirmed that my new user has valid, non-null values in the identity and the authoritative source that match what I’m looking for in the trigger filters. That all looks good.
Then in Applications \ Rapid Setup, I setup my authoritative source under the Joiner section and I enabled 'Automatically Start Joiner Processing for Newly Created Identities and Saved it
I added my test user to the authoritative source and when I run the refresh task to try to trigger Joiner on my new identity I get this error:
Maximum refresh exceptions reached
An unexpected error occurred: java.lang.NullPointerException: Cannot invoke “sailpoint.object.Identity.getAttribute(String)” because “prevIdentity” is null
I’ve set a filter in the refresh task so it’s only looking at my one new identity.
When I turn off ‘process events’, it completes, but of course that doesn’t trigger Joiner. But when I turn on ‘process events’ it errors out with the above error.
Since this is straight out of the box I’m not sure what’s going on.
I don’t have any custom rules.
I checked my global mappings and there is only one rule there and it’s pretty straightforward - I confirmed that it’s doing a null check on everything.
I checked the database for any orphaned links and found none.
I checked the identity for any missing attributes and all the key attributes are populated.
I’m not sure what else to check from here. Has anyone had this issue? Or are there any ideas on what I can look at? This is the very first step setting this up out of the box so I’m a little frustrated that I’m having issues already. I expected to run into things later on when I start applying rules and special cases, but so far I’ve done nothing but setup the basics.
Any help with how to troubleshoot this or what I can look at is appreciated.
Hi @karen_delucia - Can you enable “Automatically Join New Empty Identities” globally on the RapidSetup Joiner configuration and see if that works. It bypasses the filter. Since it is a brand new identity, there is no previous one to check against so it is null. Do you have an identity Attribute rule that uses prevIdentity or have Mover enabled? You mentioned you setup a simple trigger filter. Is that under “included identities” something like a match list on the RapidSetup Joiner event or is it on the joiner global setting?
Ultimately I don’t want to use ‘Automatically Join New Empty Identities’ because we will have some identities aggregating in from other domains that are not the authoritative source where we don’t want joiner to run. But for now, I turned it on and ran the refresh and I get the same error.
I don’t have any identity attribute rules that use prevIdentity and I don’t have Mover enabled. I verified that the one rule in the global mappings isn’t using prevIdentity.
The trigger filter I have setup is in the joiner global settings. It just checks if a cost code value = a specific string and if the employee status is changed to active.
@karen_delucia AH! so the filter has changed to? I am pretty sure that will look at prevIdentity to determine the change. I’ll run a quick test and see.
I changed the trigger filter from ‘changed to’ to ‘equals’ and the refresh task worked with no errors. I also see the Joiner event listed in the identity now.
Nothing else seems to have triggered, but at least I’m making progress.
So, it was my understanding that I wanted to use ‘changed to’ in order to prevent the joiner from running on every identity that has that matching cost code. I only want it to run on new identities. It appears that it only ran on this one identity so maybe I was wrong about that ‘changed to’ setting. I guess I need to dig into the doc a little deeper!
I’ll keep pushing forward to see if I can confirm what’s happening and what’s not.
That is some progress! I was able to test and under those conditions, Joiner does not trigger because the value was not changed, however I do not get the NPE on prevIdentity. How is the status attribute initially set?