Getting exception "could not initialize proxy - no Session" during leaver lifecycle event

Lifecycle & Governance
, ,
1

Hi Everyone,

We have just upgraded from IIQ 8.1P5 to IIQ 8.3P1. We are using Accelerator Pack configuration with some customizations for leaver lifecycle event. Post upgrade, when leaver is triggered, the provisioning is happening as expected (i.e. disabling of target application accounts), however, right after the provisioning is done (And before the “Provision” step ends), this giving us the below exception.

2023-01-09T06:42:44,548 ERROR Thread-1190 sailpoint.provisioning.IIQEvaluator:397 - Unable to complete provisionioning on user EBRNRJJ.
org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session
at org.hibernate.collection.internal.AbstractPersistentCollection.throwLazyInitializationException(AbstractPersistentCollection.java:606) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:218) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at org.hibernate.collection.internal.AbstractPersistentCollection.initialize(AbstractPersistentCollection.java:585) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at org.hibernate.collection.internal.PersistentList.remove(PersistentList.java:188) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at sailpoint.provisioning.IIQEvaluator.processAssignedRoles(IIQEvaluator.java:1450) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1144) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1109) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1062) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.provision(IIQEvaluator.java:336) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.PlanEvaluator.execute(PlanEvaluator.java:869) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.PlanEvaluator.execute(PlanEvaluator.java:738) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Provisioner.execute(Provisioner.java:1732) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.workflow.IdentityLibrary.provisionProject(IdentityLibrary.java:3199) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at jdk.internal.reflect.GeneratedMethodAccessor4347.invoke(Unknown Source) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
at sailpoint.server.ScriptletEvaluator.doCall(ScriptletEvaluator.java:134) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.server.ScriptletEvaluator.evalSource(ScriptletEvaluator.java:63) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.evalSource(Workflower.java:5932) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5171) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchInner(Workflower.java:2813) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launch(Workflower.java:2666) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launch(Workflower.java:2500) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.request.WorkflowRequestExecutor.execute(WorkflowRequestExecutor.java:177) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.request.RequestHandler.run(RequestHandler.java:163) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
2023-01-09T06:42:44,613 ERROR Thread-1190 sailpoint.server.ScriptletEvaluator:143 - Step call threw an exception:
2023-01-09T06:42:44,618 ERROR Thread-1190 sailpoint.server.ScriptletEvaluator:144 - sailpoint.tools.GeneralException: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session
at sailpoint.provisioning.IIQEvaluator.provision(IIQEvaluator.java:421)
at sailpoint.provisioning.PlanEvaluator.execute(PlanEvaluator.java:869)
at sailpoint.provisioning.PlanEvaluator.execute(PlanEvaluator.java:738)
at sailpoint.api.Provisioner.execute(Provisioner.java:1732)
at sailpoint.workflow.IdentityLibrary.provisionProject(IdentityLibrary.java:3199)
at jdk.internal.reflect.GeneratedMethodAccessor4347.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at sailpoint.server.ScriptletEvaluator.doCall(ScriptletEvaluator.java:134)
at sailpoint.server.ScriptletEvaluator.evalSource(ScriptletEvaluator.java:63)
at sailpoint.api.Workflower.evalSource(Workflower.java:5932)
at sailpoint.api.Workflower.advanceStep(Workflower.java:5171)
at sailpoint.api.Workflower.advance(Workflower.java:4558)
at sailpoint.api.Workflower.startCase(Workflower.java:3144)
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474)
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367)
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158)
at sailpoint.api.Workflower.advance(Workflower.java:4558)
at sailpoint.api.Workflower.startCase(Workflower.java:3144)
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474)
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367)
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158)
at sailpoint.api.Workflower.advance(Workflower.java:4558)
at sailpoint.api.Workflower.startCase(Workflower.java:3144)
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474)
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367)
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158)
at sailpoint.api.Workflower.advance(Workflower.java:4558)
at sailpoint.api.Workflower.startCase(Workflower.java:3144)
at sailpoint.api.Workflower.launchInner(Workflower.java:2813)
at sailpoint.api.Workflower.launch(Workflower.java:2666)
at sailpoint.api.Workflower.launch(Workflower.java:2500)
at sailpoint.request.WorkflowRequestExecutor.execute(WorkflowRequestExecutor.java:177)
at sailpoint.request.RequestHandler.run(RequestHandler.java:163)
Caused by: org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session
at org.hibernate.collection.internal.AbstractPersistentCollection.throwLazyInitializationException(AbstractPersistentCollection.java:606)
at org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:218)
at org.hibernate.collection.internal.AbstractPersistentCollection.initialize(AbstractPersistentCollection.java:585)
at org.hibernate.collection.internal.PersistentList.remove(PersistentList.java:188)
at sailpoint.provisioning.IIQEvaluator.processAssignedRoles(IIQEvaluator.java:1450)
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1144)
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1109)
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1062)
at sailpoint.provisioning.IIQEvaluator.provision(IIQEvaluator.java:336)
… 33 more

2023-01-09T06:42:44,622 ERROR Thread-1190 sailpoint.api.Workflower:4597 - An unexpected error occurred: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session
sailpoint.tools.GeneralException: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session
at sailpoint.provisioning.IIQEvaluator.provision(IIQEvaluator.java:421) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.PlanEvaluator.execute(PlanEvaluator.java:869) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.PlanEvaluator.execute(PlanEvaluator.java:738) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Provisioner.execute(Provisioner.java:1732) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.workflow.IdentityLibrary.provisionProject(IdentityLibrary.java:3199) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at jdk.internal.reflect.GeneratedMethodAccessor4347.invoke(Unknown Source) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
at sailpoint.server.ScriptletEvaluator.doCall(ScriptletEvaluator.java:134) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.server.ScriptletEvaluator.evalSource(ScriptletEvaluator.java:63) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.evalSource(Workflower.java:5932) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5171) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcase(Workflower.java:5474) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchSubcases(Workflower.java:5367) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advanceStep(Workflower.java:5158) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.advance(Workflower.java:4558) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.startCase(Workflower.java:3144) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launchInner(Workflower.java:2813) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launch(Workflower.java:2666) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.api.Workflower.launch(Workflower.java:2500) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.request.WorkflowRequestExecutor.execute(WorkflowRequestExecutor.java:177) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.request.RequestHandler.run(RequestHandler.java:163) [identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
Caused by: org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session
at org.hibernate.collection.internal.AbstractPersistentCollection.throwLazyInitializationException(AbstractPersistentCollection.java:606) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:218) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at org.hibernate.collection.internal.AbstractPersistentCollection.initialize(AbstractPersistentCollection.java:585) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at org.hibernate.collection.internal.PersistentList.remove(PersistentList.java:188) ~[hibernate-core-5.4.27.Final.jar:5.4.27.Final]
at sailpoint.provisioning.IIQEvaluator.processAssignedRoles(IIQEvaluator.java:1450) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1144) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1109) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.processIIQPlan(IIQEvaluator.java:1062) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
at sailpoint.provisioning.IIQEvaluator.provision(IIQEvaluator.java:336) ~[identityiq.jar:8.3p1 Build 482e85d988b-20220829-142216]
… 33 more

Any idea what might be wrong here?

2

Hi  @pragati_agarwal95  -

I’ve found the following previous posts regarding the error:

<span>org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: sailpoint.object.Identity.assignedRoles, could not initialize proxy - no Session</span>

The following tracing can be used to get a deep look into your custom Leaver workflow and any custom code you have:

:diamond_suit:NOTE​:diamond_suit: Verbose trace levels (TRACE, ALL) should be set in lower environments if possible; this level of logging can cause performance issues on high-volume environments
:diamond_suit:NOTE​:diamond_suit: DO NOT leave tracing in place after logs are captured or problem is resolved

<span>logger.WorkflowTrace.name=sailpoint.WorkflowTrace</span><br><span>logger.WorkflowTrace.level=all<br>logger.bsfRuleRunner.name=sailpoint.server.BSFRuleRunner<br>logger.bsfRuleRunner.level=all<br></span>

3

We were able to resolve this. It was having because of the Provisioner API.

4

Hi  @pragati_agarwal95 ,

I am having the same issue, could you please be more precise about how you solved this issue ?

Thanks

Regards

5

@npoirier  In AfterProvisioning rule for Active Directory, we were using the Provisioner API to execute a plan. Since a lot has changed in the provisioner API post upgrade, it was giving us the issue.

To fix it, we called LCM Provisioning workflow to execute the plan.

6

Hi Pragati,

I am facing the same issue. What was the fix that you applied for Provisioner?

Thanks in advance,

Gaurav

7

@gauravvijayvargiya  Instead of using Provisioner API, we used LCM Provisioning workflow for provisioning the plan.

8

@pragati_agarwal95  can you please share the code to call the workflow? Did you include that logic in After provisioning rule?