Snowflake Connector - Null Pointer during account aggregation

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hello All,

I’m having an issue with an out of the box connector (Snowflake) where we are encountering a null pointer exception when trying to do an account aggregation. This randomly started happening, but the group aggregation still pulls groups with no issues. Test connection also works with no issues.

I’ve tried going into the CCG logs, but it doesn’t point to any obvious issues. I’ve also tried resetting the source accounts & groups, but that does not appear to help either.

Any other ideas of what to try?

2 Likes
2

Hi Tyler, can you share the full stack trace for that NullPointerException? Specially, if you notice the lines showing the method and file, it can give an idea of what may be causing the issue. For example: is it happening in buildAccount() method?

3

Sure thing, here are those!

{"exception":{"stacktrace":"java.lang.NullPointerException\n\tat openconnector.connector.snowflake.SnowflakeCloudIterator.prepareUserRoles(SnowflakeCloudIterator.java:529)\n\tat openconnector.connector.snowflake.SnowflakeCloudIterator.lambda$addRolesToUserObject$8(SnowflakeCloudIterator.java:359)\n\tat java.base\/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1655)\n\tat java.base\/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:658)\n\tat openconnector.connector.snowflake.SnowflakeCloudIterator.addRolesToUserObject(SnowflakeCloudIterator.java:322)\n\tat openconnector.connector.snowflake.SnowflakeCloudIterator.fetchFirstPartitionForUser(SnowflakeCloudIterator.java:154)\n\tat openconnector.connector.snowflake.SnowflakeCloudIterator.runAccountAggregation(SnowflakeCloudIterator.java:92)\n\tat openconnector.connector.snowflake.SnowflakeCloudIterator.hasNext(SnowflakeCloudIterator.java:64)\n\tat sailpoint.connector.OpenConnectorAdapter$AdapterIterator.hasNext(OpenConnectorAdapter.java:1800)\n\tat sailpoint.connector.ConnectorProxy$CustomizingIterator.peek(ConnectorProxy.java:1446)\n\tat sailpoint.connector.ConnectorProxy$CustomizingIterator.hasNext(ConnectorProxy.java:1473)\n\tat com.sailpoint.ccg.aggregation.util.CisSourceIterator.hasNext(CisSourceIterator.java:46)\n\tat com.sailpoint.aggregation.server.service.extract.BaseExtractor.extract(BaseExtractor.java:241)\n\tat com.sailpoint.aggregation.server.service.extract.BaseExtractor.extractObjects(BaseExtractor.java:120)\n\tat com.sailpoint.aggregation.server.service.extract.AccountExtractor.extractObjects(AccountExtractor.java:16)\n\tat com.sailpoint.aggregation.server.service.SourceAggregator.aggregateAccounts(SourceAggregator.java:72)\n\tat com.sailpoint.ccg.handler.StreamingAggregationHandler.invoke(StreamingAggregationHandler.java:190)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler.handleMessage_aroundBody0(CcgPipelineMessageHandler.java:45)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler$AjcClosure1.run(CcgPipelineMessageHandler.java:1)\n\tat org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:167)\n\tat com.sailpoint.tracing.otel.TracedAspect.lambda$traceExecution$0(TracedAspect.java:38)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:170)\n\tat com.sailpoint.tracing.otel.GlobalTracer.trace(GlobalTracer.java:143)\n\tat com.sailpoint.tracing.otel.TracedAspect.traceExecution(TracedAspect.java:40)\n\tat sailpoint.gateway.accessiq.CcgPipelineMessageHandler.handleMessage(CcgPipelineMessageHandler.java:37)\n\tat com.sailpoint.pipeline.server.PipelineServer$InboundQueueListener$MessageHandler.run(PipelineServer.java:382)\n\tat java.base\/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)\n\tat java.base\/java.util.concurrent.FutureTask.run(FutureTask.java:264)\n\tat java.base\/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)\n\tat java.base\/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)\n\tat java.base\/java.lang.Thread.run(Thread.java:829)\n","exception_class":"java.lang.NullPointerException"},"stack":"ccg","pod":"","connector-logging":"164","Operation":"Iterate","clusterId":"2c918085843dce590184439de8216a08","utilities":"1.12.2","buildNumber":"1069","apiUsername":"218b8bad-cdf3-4a0e-a99f-a727442a6044","ObjectType":"account","orgType":"","file":"ExtractionContext.java","encryption":"1.12.2","messageType":"streaming-aggregation","connector-bundle-identityiq":"257","line_number":210,"@version":1,"CB_version":"1611","cloud-modules-api":"2.1.2","logger_name":"com.sailpoint.aggregation.server.service.extract.ExtractionContext","mantis-client":"1.12.2","class":"com.sailpoint.aggregation.server.service.extract.ExtractionContext","atlas-api":"2.7.1","va-gateway-client":"60","connector-bundle-utilities":"10","tracing":"1.12.2","clientId":"218b8bad-cdf3-4a0e-a99f-a727442a6044","source_host":"abd25c4e5747","method":"setError","org":"XXXXX","level":"ERROR","IdentityIQ":"8.3p4 Build 4cd878af669-20241202-173620","message":"Setting error java.lang.NullPointerException","pipeline":"1.12.2","@timestamp":"2025-05-29T18:09:13.501Z","thread_name":"pool-6-thread-73","atlas-util":"2.7.1","metrics":"1.10.5","region":"us-east-1","AppType":"Snowflake","Application":"SnowFlake People Analytics [source]","request_id":"9707e426-237f-496f-bc2d-b1166737c48a","CB_Type":"connector-bundle-webservices","queue":"","SCIM Common":"8.0 Build 00b1f252d1b-20200225-190809"}
4

From the trace it seems, a user data coming from Snowflake contains null in roles list or an object is null which connector using. If you can, query (using API?) Snowflake to find any user without roles/or role grant issue/or role has corrupted (control character or improper encoding etc.) data, that can pinpoint the exact problem.

Also, if you can set debug logging for Snowflake connector, that will give us more insights.

5

We also seem to have the same issue with Snowflake Connector. The users who are requesting for a new access profile on the Snowflake endpoint are also getting the same error. As an Admin when I try to assign the access profile thru a “Submit Access Request” API, I could see the user’s events logs point to “Java Null pointer exception”.

How can we enable debug logging. I couldn’t find any option to enable it on the Snowflake Connector configuration.

Thanks
Vaseem

6

We are on IIQ 8.4p2 and here is the trace we see before nullpointerexception in prepareUserRoles:

2025-07-08T10:39:40,598 TRACE QuartzScheduler_Worker-3 openconnector.connector.snowflake.SnowflakeCloudIterator:97 - Entering prepareUserRoles: Arguments => {name=myusername, login_name=myusername@mydomain.COM, display_name=myusername, first_name=fname, last_name=lname, email=myusername@mydomain.com, days_to_expiry=null, comment=null, *disabled*=false, disabled=false, must_change_password=false, snowflake_lock=false, default_warehouse=RSP_TEST_DEV, default_namespace=null, default_role=null, default_secondary_roles=["ALL"], owner=SNOWFLAKE_PROVISIONER}, [1751260617.224, CREATE SCHEMA, DATABASE, USER$myusername, null, USER, myusername, false, ]
2025-07-08T10:39:40,599 TRACE QuartzScheduler_Worker-3 openconnector.connector.snowflake.SnowflakeUtil:97 - Entering getIndexOfAttribute: Arguments => [created_on, privilege, granted_on, name, role, granted_to, grantee_name, grant_option, granted_by], role
2025-07-08T10:39:40,599 TRACE QuartzScheduler_Worker-3 openconnector.connector.snowflake.SnowflakeUtil:108 - Exiting getIndexOfAttribute: Arguments => [created_on, privilege, granted_on, name, role, granted_to, grantee_name, grant_option, granted_by], role, Returns => 4
2025-07-08T10:39:40,599 TRACE QuartzScheduler_Worker-3 openconnector.connector.snowflake.SnowflakeCloudIterator:115 - Throwing prepareUserRoles - java.lang.NullPointerException
7

If Snowflake returned null or an unexpected structure for roles for a user, and the connector isn’t handling that null defensively, Seems like role shouldn’t be null for any account
Can you remove the role from schema and see iof the aggregation is fine ?

8

It seems to be related to Workspace on Snowflake. If someone uses it, there are entries with null role assignments

9

Fixed in July Release
CONETN-5096
Connectivity - Snowflake CONETN-5096 The Snowflake connector no longer fails with NullPointerException error during single account aggregation.

11

Hi Vishal, this issue is also present in IdentityIQ. Do you know if there is a planned fix or should I request an e-fix?

12

You can raise the support ticket and check if they could provide efix.

13

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.