Summary

External User Directory Synchronisation fails with error 'java.lang.NullPointerException' in the logs

Environment

External AD is Microsoft Active Directory . 

Diagnosis

Below events can be seen in atlassian-confluence.log:

2023-01-09 14:20:13,617 ERROR [Caesium-1-3] [atlassian.crowd.directory.DbCachingDirectoryPoller] pollChanges Error occurred while refreshing the cache for directory [ XXXXXXXXX ].
java.lang.NullPointerException
	at java.naming/javax.naming.ldap.Rfc2253Parser.<init>(Unknown Source)
	at java.naming/javax.naming.ldap.LdapName.parse(Unknown Source)
	at java.naming/javax.naming.ldap.LdapName.<init>(Unknown Source)
	at com.atlassian.crowd.directory.MicrosoftActiveDirectory.fetchInvocationId(MicrosoftActiveDirectory.java:716)
	at com.atlassian.crowd.directory.synchronisation.cache.UsnChangedCacheRefresher.synchroniseAll(UsnChangedCacheRefresher.java:179)
	at com.atlassian.crowd.directory.DbCachingRemoteDirectory.synchroniseCache(DbCachingRemoteDirectory.java:1098)
	at com.atlassian.crowd.manager.directory.DirectorySynchroniserImpl.lambda$synchronise$0(DirectorySynchroniserImpl.java:82)
	at com.atlassian.crowd.audit.NoOpAuditLogContext.withAuditLogSource(NoOpAuditLogContext.java:17)
	at com.atlassian.crowd.manager.directory.DirectorySynchroniserImpl.synchronise(DirectorySynchroniserImpl.java:80)
	at com.atlassian.crowd.directory.DbCachingDirectoryPoller.pollChanges(DbCachingDirectoryPoller.java:45)
	at com.atlassian.crowd.manager.directory.monitor.poller.DirectoryPollerJobRunner.runJob(DirectoryPollerJobRunner.java:92)

Cause

• Taking a close look at the logs will tell us that the sync is failing at "MicrosoftActiveDirectory.fetchInvocationId".
• Confluence tries to get the InvocationID from the AD server, as per this change performed for   CWD-2783 - Getting issue details... STATUS .
• Invocation Id is AD instance identifier. Confluence uses it to detect if it is synchronising against the same AD node as in previous synchronisation.
• This is important when AD is load balanced. If AD invocationId is changed, then Confluence will fallback to full synchronisation.
• InvocationId is also fetched during full synchronisation (for future incremental synchronisations - even if incremental synchronisation is disabled).
• Incase the AD returns a Null invocation ID , Confluence will throw a Null pointer exception
• The reason why AD returns a Null Invocation ID , needs to be checked with the AD admin

Solution

• Change the directory type for your user directory to "Generic Directory server" 
  
• When the Directory Type is "Generic Directory server"  , invocation Id will not be fetched