Null Value on Attribute Request

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.3

Share all details about your problem, including any error messages you may have received.

Hi everyone,

I’m working with IIQ v8.3, and I’ve run into a sporadic Null Pointer Exception in the Before Provisioning Rule for an Active Directory integration.

The exception is triggered by this block of code when calling getValue() on the cn attribute:

if (accountRequest.getAttributeRequest("cn") != null) {
    AttributeRequest cn = accountRequest.getAttributeRequest("cn");
    cn.setValue("CN=" + cn.getValue()));
    cn.setName("AC_NewName");
    isPlanUpdated = true;
}

From the logs, I found a Provisioning Plan that includes multiple AttributeRequests without values. One of them is cn, which causes the Null Pointer Exception.

ProvisioningPlan
ProvisioningPlan1572×646 14.5 KB

My question is what could be the origin of a Provisioning Plan that includes AttributeRequests with null values—specifically for cn and distinguishedName?

Is there a recommended way to prevent such plans from being generated in the first place, rather than just adding a null check in the rule?

Any insights into how these empty AttributeRequests might be introduced—or best practices for handling them—would be greatly appreciated.

Thanks in advance!

2

check your provision policy for this application and look at the value setting. You should populate all the values there itself for these attributes.

3

Check the provision policies you defined on the application. There might be the CN is getting null value.

4

In our Provisioning Policy, the only scenario where attributes like givenName and sn return null is when the identity itself lacks the corresponding basic attributes.

For example:

case "givenName": {
    if (Util.isNullOrEmpty(identity.firstname))
        return null;

    return capitalize(identity.firstname);
}
break;

case "sn": {
    if (Util.isNullOrEmpty(identity.lastname))
        return null;

    return identity.lastname.toUpperCase();
}
break;

So unless the identity is missing both firstname and lastname, these attributes should never be null in the provisioning plan.

Could this be due to a timing issue—like the provisioning plan being generated before the identity is fully aggregated or updated?

Would it make sense to check the identity refresh or aggregation process to ensure those attributes are populated before provisioning kicks in?