Failed to locate tenant while processing token call in IDSP
Article ID: 446013
Updated On:
Products
Issue/Introduction
After upgrading IDSP from version 3.3.5 to 3.4.6 and subsequently to 4.0.3, the following error is observed during authentication:
az-server.log
{"timestamp":"2026-06-20T08:27:21.425450Z","type":"log","level":"warn","thread":"<threadId>","msg":"AuditUtil.doAudit: Failed to locate tenant '4ecb296f-c428-47b7-89ac-667d66e4a9c6' setting 'notifyEventsConfig' during auditing of ID LCM compatible event 'azserver.token.failure'. Message 'Cannot read field \\\"value\\\" because \\\"original\\\" is null'."
{"timestamp":"2026-06-20T08:27:23.582411Z","type":"log","level":"error","thread":"qtp1669705853-42","msg":"Exception in processing token call. Message : {}","__RESOURCE_APPID":"f1780ceb-4a49-4f2d-b4b1-ad7035812441","api":"/oauth2/v1/token","appId":"a4457648-a124-4b00-8cb7-c5e469088ad5","appName":"<appName>","azpName":"<azpName>","clientId":"5f4dca88-5499-421c-ad31-ee14df2628c5","clientIp":"127.0.0.1","clientTid":"4ecb296f-c428-47b7-89ac-667d66e4a9c6","clientTxnId":"4d06818c-cf35-455e-abb0-26e0c00cfe87","deploymentRegion":"sspdev-ssp","findAllFromController":"true","host":"<idsp_host>","httpMethod":"POST","isDiagnosticsEnabled":"false","issuerUrl":"https://<idsp_host>/default","method":"POST","relVersion":"1.0","service":"azserver","tid":"<tid>","tname":"default","txnId":"<txnId>","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36","userIp":"127.0.0.1","throwable":"java.lang.NullPointerException: Cannot read field \"value\" because \"original\" is null\n\tat java.base/java.lang.String.<init>(String.java:262)\n\tat com.broadcom.layer7authentication.core.service.settings.TenantSettingsService.lambda$getProperties$0(TenantSettingsService.java:95)\n\tat com.broadcom.layer7authentication.core.service.settings.TenantSettingsService.getProperties(TenantSettingsService.java:85)\n\tat com.broadcom.layer7authentication.core.service.settings.TenantSettingsService$$SpringCGLIB$$0.getProperties(<generated>)\n\tat com.broadcom.layer7authentication.core.service.settings.SettingsCache.getTenantSettings(SettingsCache.java:52)\n\tat com.broadcom.layer7authentication.core.service.oauth2.TokenGeneratorService.getATExpirySecs(TokenGeneratorService.java:1103)\n\tat com.broadcom.layer7authentication.oidcprovider.controller.TokenController.processTokenRequest(TokenController.java:420)\n\tat com.broadcom.layer7authentication.oidcprovider.controller.TokenController.token(TokenController.java:266)\n\tat
Environment
Symantec Identity Security Platform - IDSP 4.0.3
Resolution
Solution 1:
The issue is caused by duplicate entries in the T_LOGO table. The following queries can be used to identify and remove records from the T_LOGO table where the logo name is NULL:
SELECT * FROM T_LOGO WHERE LOGO_NAME IS NULL;
DELETE FROM T_LOGO WHERE LOGO_NAME IS NULL;
Solution 2:
Instead of setting the logo data to NULL, we recommend replacing it with a minimal transparent image. This keeps the data valid while effectively removing the logo from the UI. You can use the Logos API to update each logo with a 1x1 transparent PNG:
e.g.
PUT /<tenant>/admin/v1/Logos/<logoId>
{
"logo": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQABNjN9GQAAAABJREFUCNdjYAAAAAIAAeIhvDMAAAAASUVORK5CYII=",
"logoName": "transparent.png"
}
You can retrieve the current logo IDs using:
GET /<tenant>/admin/v1/Logos
From product, it is recommend to use the provided API for any logo changes rather than modifying the database directly.
Feedback
