Today we have found a bad exception (https://jira.evolveum.com/browse/MID-2376). Because of this bug when we get user or entitlement from resorce we should push it to resource, in other way we've got NPE.