Buggy behavior of DelegateTask related to identity-links

Environment:

Camunda 7.15.3-ee
Linux
PostgreSQL

Description:

1. First aspect of the problem:

In March I added a comment at https://jira.camunda.com/browse/CAM-8494 since we run into the same bug. Luckily, the mentioned workaround worked fine.

The method "getIdentityLinksForTask" in also used in another context which worked fine (a mapper which copies all task attributes into an event which is published in a Kafka-topic consumed by other applications).

Last week we had to adapt the second use-case to fulfill new requirments and suddenly the worker returns null instead a list of identity-links. This is the second usage of the task's method getIdentityLinksForTask in that transaction and the first is fine but the seconds returns that nonsense. If we disable the workaround introduced in March the new use-case works fine but now the former use-case again brings that NPE.

2. Second aspect of the problem:

We also identified another problem which we think relates also to the cache of identity-links in task-entity: On deleting a group- or user-identity link (DelegateTask#deleteCandidateUser() and DelegateTask#deleteCandidateGroup()) the cache is not updated. So subsequent calls to getIdentityLinksForTask will still return the old list of identity-links.

Since https://jira.camunda.com/browse/CAM-8494 is a bug which blocks us now we require your support to get this problem solved. Unfortunately, the is no official way to retrieve un-cached identity-links since the internal API IdentityLinkManager#findIdentityLinksByTaskId(String) is not accessable.

Steps to reproduce:

Unfortunately, it cannot be reproduced on demand. It is reproducable in our environment by an integration test, but I set up a Spring Boot environment in which the error did not happen. Maybe we can have a shared debugging-session to help you investigating the root cause.

Observed Behavior:

1. without workaround: NPE as described in https://jira.camunda.com/browse/CAM-8494
   with workaround: null from getIdentityLinksForTask instead list having one entry
2. deleting a candidate does not update response from getIdentityLinksForTask

Expected behavior:

1. No NPE without workaround
2. Consistent responses using the identity-link related methods of the DelegateTask API interface

Root Cause:

1. Unknown
2. Cache not updated/refreshed after deleting a candidate