# Remove Provisioning request from a Rule for AD

**URL:** <https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652>\
**Category:** IIQ Discussion and Questions\
**Tags:** workflows, rules, identityiq, provisioning\
**Created:** [October 22, 2024, 2:30pm UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652 "2024-10-22T14:30:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aseelvn07](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aseelvn07/32/30068_2.png) [@aseelvn07](https://developer.sailpoint.com/discuss/u/aseelvn07)\
**Post date:** [October 22, 2024, 2:30pm UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652/1 "2024-10-22T14:30:33Z")

</div>

## Which IIQ version are you inquiring about?

8.3

## Share all details about your problem, including any error messages you may have received.

Trying to create a remove provisioning request for memberOf attribute from a rule, but its not working. Getting nullpointer. ProvisioningProject ‘project’ is empty. Below is the code

```java
  Identity identity = context.getObjectByName(Identity.class, "TestUser");
  
  ProvisioningPlan plan = new ProvisioningPlan();
  String distinguishedName = "CN=TestUser,OU=Test Users,OU=Users,OU=Development,OU=App3034,OU=Services,OU=DTTL,DC=eur,DC=xyzCompany,DC=com";

  AccountRequest accountRequest = new AccountRequest();
  accountRequest.setOperation(AccountRequest.Operation.Modify);
  accountRequest.setApplication("Active Directory");
  accountRequest.setNativeIdentity(distinguishedName);
  accountRequest.add(new AttributeRequest("memberOf", ProvisioningPlan.Operation.Remove, "CN=IGADEV IL P1-S 007,OU=Security Groups,OU=Groups,OU=Development,OU=App3034,OU=Services,OU=DTTL,DC=eur,DC=xyzCompany,DC=com"));

  plan.add(accountRequest);

  plan.setNativeIdentity(identity.getName());
  plan.setIdentity(identity); 
  Provisioner provisioner = new Provisioner(context);
  ProvisioningProject project = provisioner.compile(plan);
  // provisioner.setNoLocking(true);
  provisioner.execute(project); // getting null pointer. project is empty
  context.saveObject(identity);
  context.commitTransaction();

```

---

<div class="post-metadata">

**Author:** ![pravin\_ranjan](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/pravin_ranjan/32/6771_2.png) [@pravin\_ranjan](https://developer.sailpoint.com/discuss/u/pravin_ranjan)\
**Post date:** [October 22, 2024, 2:53pm UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652/2 "2024-10-22T14:53:58Z")

</div>

```auto
plan.setNativeIdentity(identity.getName()); not needed

```

---

<div class="post-metadata">

**Author:** ![Arun-Kumar](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/arun-kumar/32/15128_2.png) [@Arun-Kumar](https://developer.sailpoint.com/discuss/u/Arun-Kumar)\
**Post date:** [October 22, 2024, 2:56pm UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652/3 "2024-10-22T14:56:43Z")

</div>

Try with this code

```auto
Identity identity = context.getObjectByName(Identity.class, "TestUser");
  
  ProvisioningPlan plan = new ProvisioningPlan();
  String distinguishedName = "CN=TestUser,OU=Test Users,OU=Users,OU=Development,OU=App3034,OU=Services,OU=DTTL,DC=eur,DC=xyzCompany,DC=com";

  AccountRequest accountRequest = new AccountRequest();
  accountRequest.setOperation(AccountRequest.Operation.Modify);
  accountRequest.setApplication("Active Directory");
  accountRequest.setNativeIdentity(distinguishedName);
  accountRequest.add(new AttributeRequest("memberOf", ProvisioningPlan.Operation.Remove, "CN=IGADEV IL P1-S 007,OU=Security Groups,OU=Groups,OU=Development,OU=App3034,OU=Services,OU=DTTL,DC=eur,DC=xyzCompany,DC=com"));

  plan.add(accountRequest);

 // plan.setNativeIdentity(identity.getName());
  plan.setIdentity(identity); 
  Provisioner provisioner = new Provisioner(context);
  provisioner.compile(plan);
  // provisioner.setNoLocking(true);
  provisioner.execute(); 

```

---

<div class="post-metadata">

**Author:** ![officialamitguptaa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/officialamitguptaa/32/6624_2.png) [@officialamitguptaa](https://developer.sailpoint.com/discuss/u/officialamitguptaa)\
**Post date:** [October 22, 2024, 3:50pm UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652/4 "2024-10-22T15:50:46Z")

</div>

@aseelvn07 -

The NullPointerException you’re encountering is likely due to the `ProvisioningProject` being empty because the provisioning plan isn’t correctly constructed.

Specifically, You have set the **Incorrect Native Identity**. Ideally when you perform any provisioning operation like create,modify,enable,disable etc. The native Identity should be the unique attribute on the Application side not on the SailPoint side.

Below is the working version of your code -

```java
import sailpoint.object.Identity;
import sailpoint.object.Filter;
import org.apache.log4j.Logger;
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.api.Provisioner;
import sailpoint.object.ProvisioningProject;
import sailpoint.object.Link;

String userLogin="1a2b3a";
Identity identity = context.getObjectByName(Identity.class, "1a2b3a");

// Initialize the provisioning plan and set the identity
ProvisioningPlan plan = new ProvisioningPlan();
plan.setIdentity(identity);

// Create the account request
AccountRequest accountRequest = new AccountRequest();
accountRequest.setOperation(AccountRequest.Operation.Modify);
accountRequest.setApplication("Active Directory");

// Retrieve the native identity (account ID) from the user's link to Active Directory
Link link = identity.getLink("Active Directory");
if (link != null) {
    accountRequest.setNativeIdentity(link.getNativeIdentity());
} else {

   System.out.println("Identity does not have an account on Active Directory");
}

// Define the group DN to remove
String groupDn = "CN=Buggy group 3,OU=Groups,DC=acme,DC=local";

// Create the attribute request to remove the group
AttributeRequest attrRequest = new AttributeRequest("memberOf", ProvisioningPlan.Operation.Remove, groupDn);
accountRequest.add(attrRequest);

// Add the account request to the plan
plan.add(accountRequest);
System.out.println(plan.toXml());

// Compile and execute the provisioning project
Provisioner provisioner = new Provisioner(context);
ProvisioningProject project = provisioner.compile(plan);

if (project != null && !project.isEmpty()) {
    provisioner.execute(project);
    context.saveObject(identity);
    context.commitTransaction();
    System.out.println("Execution Succeded.");
} else {
    System.out.println("Provisioning project is empty");
}

```

Thank you!

---

<div class="post-metadata">

**Author:** ![Abhishek\_1995](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Abhishek\_1995](https://developer.sailpoint.com/discuss/u/Abhishek_1995)\
**Post date:** [October 23, 2024, 3:56am UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652/5 "2024-10-23T03:56:44Z")

</div>

Hi @aseelvn07,

I think this line “ProvisioningProject project = provisioner.compile(plan);” may be you are getting null value.  
Please use null checks.

```auto
Provisioner provisioner = new Provisioner(context);
ProvisioningProject project = provisioner.compile(plan);

if (project == null || project.getAccountRequests().isEmpty()) {
    throw new RuntimeException("Provisioning project is empty after compilation.");
}

// provisioner.setNoLocking(true);
provisioner.execute(project);

context.saveObject(identity);
context.commitTransaction();

```

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [December 22, 2024, 3:57am UTC](https://developer.sailpoint.com/discuss/t/remove-provisioning-request-from-a-rule-for-ad/86652/6 "2024-12-22T03:57:25Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.