On Access request Page - User click on Remove Access then getting Severe Error

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ versiSailon are you inquiring about?

[SailPoint IIQ8.3]

Please share any images or screenshots, if relevant.

When User Click on Remove Access on Access Request page its throwing below error-

 
java.lang.NullPointerException: Cannot invoke "sailpoint.object.Entitlements.getAttributes()" because "ent" is null

Please share any other relevant files that may be required (for example, logs).

[Please insert files here, otherwise delete this section]

Share all details about your problem, including any error messages you may have received.

[Replace this text with the problem that you are facing]

2

The stack trace suggests IIQ is trying to remove an entitlement whose object reference is resolving to null. In other words, the access item is visible in the request flow, but the underlying entitlement/managed attribute is missing, stale, or not being resolved correctly at runtime.

I’d validate:

  • the entitlement still exists in IIQ and is properly correlated,
  • there is no custom workflow/rule on Remove Access that calls getAttributes() without checking for null,
  • and the application/account aggregation plus catalog state are in sync.

If this is customized, add defensive null handling around entitlement resolution and log which entitlement/app/native identity is failing before getAttributes() is called. That should quickly tell you whether this is bad data, stale catalog state, or a customization defect.

import sailpoint.object.Attributes;
import sailpoint.object.Entitlements;
import sailpoint.tools.GeneralException;

public Attributes getSafeEntitlementAttributes(Entitlements ent,
                                               String identityName,
                                               String applicationName,
                                               String entitlementValue) throws GeneralException {
    if (ent == null) {
        String msg = "Remove Access error: entitlement is null"
            + " [identity=" + identityName
            + ", application=" + applicationName
            + ", entitlement=" + entitlementValue + "]";
        log.error(msg);
        throw new GeneralException(msg);
    }

    Attributes attrs = ent.getAttributes();
    if (attrs == null) {
        log.warn("Entitlement attributes are null"
            + " [identity=" + identityName
            + ", application=" + applicationName
            + ", entitlement=" + entitlementValue + "]");
    }

    return attrs;
}
3

Please check the object of the Entitlement that you are trying to remove through debug page. Make sure that it is available and also make sure that your identity has the attributeAssignment tag for that particular entitlement that you are trying to remove in the identity object.

4

Hi @cbskiet1986, could you please check a few things:

  • Verify the entitlement under Accounts → Entitlements for the user
  • Run Account Aggregation and try again
  • Let me know if the issue is for all users or just one
  • Share a screenshot if possible

This will help us debug the issue quickly. Thanks!

5

The error states below pointers, can you please check

  1. Entitlement data not properly loaded in Identity Cube
  2. Role/Entitlement was deleted but still referenced in Identity
  3. trying to access stale entitlement data
  4. Corrupted entitlement aggregation data
    • Entitlement may have been already removed
      via direct aggregation
  6. Entitlement may have been revoked previously
  7. Identity Refresh may not have run after
    the entitlement was removed

The below step can be implemented to fix the issue:

-Run Identity Refresh for that specific user

  • Re-aggregate the application for that user
  • Once refresh is complete, retry the
    Remove Access request
6

Hi @cbskiet1986 Can you share more detailed steps? When the user is selected, remove the tab at the top of the access request, or click on particular entitlements. it might look like an extended attribute issue. Can you share more logs?

Thanks,

PVR.

7

Thank you all, this issue has been resolved.

Root Cause Analysis: Entitlement does not exist in Entitlement Catalog while its assigned to user and added in . To test this we removed the entitlement via debug page from and issue has been resolved.

8

@cbskiet1986 could you please mark your response here as the solution to help others who may be facing a similar issue in the future