Policy Xpress Policy Fails with Null Pointer Exception when Iterator List is Empty - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

When a Policy Xpress (PX) policy uses an iterator to fetch and process user roles, the policy fails if the user has no assigned roles. You may observe an error such as Policy Xpress Failed to evaluate policy or Missing parameter. This occurs because the policy attempts to evaluate attribute data inside the iterator before validating the list itself.

Environment

Identity Manager 14.5

Cause

Policy Xpress evaluates boolean conditions in a strict sequence (short-circuit logic). If your entry rule tests attributes belonging to an iterator (e.g., Role_Admin_Email) before checking if the iterator list is empty (e.g., get_Role_List), the policy attempts to extract values from a null object.

Example of incorrect sequence: (Role_Admin_Email Not equals "") AND (Disabled_State_Changed Equals "true")...

In this example, the policy fails immediately because it cannot retrieve Role_Admin_Email if the list is empty.

Resolution

To resolve this, reorder your entry rule conditions to place the existence check for the list at the beginning of the sequence. By placing the list validation first, the policy stops evaluation if the list is empty, preventing the iterator from triggering a null pointer exception.

1. Access the Entry Rule configuration within your Policy Xpress policy.
2. Ensure that the check for the list container is the first condition in your AND sequence.
3. Example of corrected logic: (get_Role_List Not equals "") AND (Role_Admin_Email Not equals "") AND (Disabled_State_Changed Equals "true")
4. Save the policy.
5. The policy now effectively "short-circuits" if get_Role_List is empty, avoiding further evaluation of the null attributes.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.