[midPoint] IllegalStateException: Trying to load shadow with null OID

[Alcides Moraes]

Hello list,

I’ve been struggling with this error for quite some time.
Some accounts fail to be created with this error (some of the stack trace)
java.lang.IllegalStateException: Trying to load shadow with null OID (reason for load: strong outbound mapping) for account(no ID, type 'default', resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD))
	at com.evolveum.midpoint.model.impl.lens.projector.loader.ProjectionFullLoadOperation.loadFullShadow(ProjectionFullLoadOperation.java:105)
	at com.evolveum.midpoint.model.impl.lens.projector.ContextLoader.loadFullShadow(ContextLoader.java:227)
	at com.evolveum.midpoint.model.impl.lens.construction.ResourceObjectConstruction.loadFullShadow(ResourceObjectConstruction.java:510)
	at com.evolveum.midpoint.model.impl.lens.construction.EvaluatedResourceObjectConstructionImpl.loadFullShadow(EvaluatedResourceObjectConstructionImpl.java:314)
	at com.evolveum.midpoint.model.impl.lens.construction.ConstructionEvaluation.loadFullShadowIfNeeded(ConstructionEvaluation.java:140)
	at com.evolveum.midpoint.model.impl.lens.construction.ItemEvaluation.evaluate(ItemEvaluation.java:126)
	at com.evolveum.midpoint.model.impl.lens.construction.ConstructionEvaluation.evaluateAssociations(ConstructionEvaluation.java:128)
	at com.evolveum.midpoint.model.impl.lens.construction.ConstructionEvaluation.evaluate(ConstructionEvaluation.java:96)
	at com.evolveum.midpoint.model.impl.lens.construction.EvaluatedResourceObjectConstructionImpl.evaluate(EvaluatedResourceObjectConstructionImpl.java:253)
	at com.evolveum.midpoint.model.impl.lens.construction.ResourceObjectConstruction.evaluateConstructions(ResourceObjectConstruction.java:198)
	at com.evolveum.midpoint.model.impl.lens.construction.ResourceObjectConstruction.evaluate(ResourceObjectConstruction.java:113)
	at com.evolveum.midpoint.model.impl.lens.assignments.EvaluatedAssignmentImpl.evaluateConstructions(EvaluatedAssignmentImpl.java:369)
	at com.evolveum.midpoint.model.impl.lens.projector.focus.AssignmentProcessor.evaluateConstructions(AssignmentProcessor.java:652)
	at com.evolveum.midpoint.model.impl.lens.projector.focus.AssignmentProcessor.evaluateConstructions(AssignmentProcessor.java:638)

Tracing the logs, I have come to the suspicion that midpoint is trying to load the AD account shadow before creating it.
I do have some strong outbound mappings with associations inside weak constructions, that gives some ad groups to the accounts.
With some tracing I can see that these constructions are being resolved before the AD account construction is resolved. 
Is this a bug? Or am I doing something wrong somewhere?

Trace logs before the exception

2023-03-07T20:45:28.307 TRACE [com.evolveum.midpoint.model.impl.lens.construction.ResourceObjectConstruction] (http-nio-8080-exec-6) Evaluating construction 'Construction(PCV(null):[PP({.../common/common-3}description):[PPV(String:group member association)], PP({.../common/common-3}strength):[PPV(ConstructionStrengthType:WEAK)], PrismReferenceImpl({.../common/common-3}resourceRef):[PRV(oid=3341f1ce-f96f-43fe-8bc9-7a9ec051b71b, targetType={.../common/common-3}ResourceType, relation={.../common/org-3}default)], PP({.../common/common-3}kind):[PPV(ShadowKindType:ACCOUNT)], PP({.../common/common-3}intent):[PPV(String:default)], PC(association):[PCV(3):[PP({.../common/common-3}ref):[PPV(ItemPathType:group)], PC(outbound):[PCV(null):[PP({.../common/common-3}strength):[PPV(MappingStrengthType:STRONG)], PP({.../common/common-3}expression):[PPV(ExpressionType:ExpressionType(variable=[],evaluator=associationFromLink:com.evolveum.midpoint.xml.ns._public.common.common_3.AssociationFromLinkExpressionEvaluatorType at 4c538379[assignmentPathIndex=-3,recurseUpOrgType=<null>,description=<null>,documentation=<null>,projectionDiscriminator=PCV(null):[PP({.../common/common-3}kind):[PPV(ShadowKindType:ENTITLEMENT)], PP({.../common/common-3}intent):[PPV(String:adGroup)]]]))]]]]]] in role:5df4e077-2c04-4b6c-aefe-d62d2b5715e6(Metarole - Automatic AD group), invalid->valid)' in role:5df4e077-2c04-4b6c-aefe-d62d2b5715e6(Metarole - Automatic AD group

)
2023-03-07T20:45:28.307 TRACE [com.evolveum.midpoint.model.impl.lens.projector.loader.ProjectionFullLoadOperation] (http-nio-8080-exec-6) Loading full resource object LensProjectionContext(ShadowType:null on resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD)) from provisioning (discovery enabled) as requested; reason: strong outbound mapping
2023-03-07T20:45:28.308 TRACE [com.evolveum.midpoint.model.impl.lens.ClockworkMedic] (http-nio-8080-exec-6) Projector component error: assignments: IllegalStateException: Trying to load shadow with null OID (reason for load: strong outbound mapping) for account(no ID, type 'default', resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD))
2023-03-07T20:45:28.308 TRACE [com.evolveum.midpoint.model.impl.lens.ClockworkMedic] (http-nio-8080-exec-6) Projector component error: focus: IllegalStateException: Trying to load shadow with null OID (reason for load: strong outbound mapping) for account(no ID, type 'default', resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD))
2023-03-07T20:45:28.308 DEBUG [com.evolveum.midpoint.model.impl.lens.projector.Projector] (http-nio-8080-exec-6) Projector failed: Trying to load shadow with null OID (reason for load: strong outbound mapping) for account(no ID, type 'default', resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD)). Etime: 4926 ms
2023-03-07T20:45:28.308 ERROR [com.evolveum.midpoint.model.impl.lens.projector.Projector] (http-nio-8080-exec-6) Runtime error in projector: Trying to load shadow with null OID (reason for load: strong outbound mapping) for account(no ID, type 'default', resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD))
java.lang.IllegalStateException: Trying to load shadow with null OID (reason for load: strong outbound mapping) for account(no ID, type 'default', resource:3341f1ce-f96f-43fe-8bc9-7a9ec051b71b(AD))