Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Records with the comment character are also fetched during aggregation

The normal behavior of a comment character (for example, #) is to distinguish comments from the records. The connector should skip any lines which contain the character.

Resolution: To prevent the aggregation of comment characters in the records, remove the comment character first and save the file. Re-enter the comment character, save the file and run the aggregation again.

Data is not correctly aggregating when merging is enabled

Resolution: In the Merging of File Settings section, enable the following checkboxes and retry the use case:

Data sorted by the indexColumn(s)

Ignore case while merging

Entitlement attributes don't populate correctly when the delimited file uses a custom delimiter

If you've defined a delimiter other than the default comma (,), aggregated entitlement data isn't populated correctly.

Resolution: In the Parsing of File Settings section, enter your custom delimiter in the text box and retry the use case. For more information, refer to Define a Group Data Parsing Delimiter.

STS AssumeRole denied... verify the target role's trust policy

The trust policy does not allow the virtual appliance's instance profile role, or the external ID does not match.

Resolution - If the message notes that Account ID was not configured, and the role is in another account, set Account ID.

STS rejected the virtual appliance's instance profile credentials

No valid instance profile is attached to the virtual appliance instance.

Resolution - Review the prerequisites. For more information, refer to Prerequisites.

Unable to read the virtual appliance's EC2 instance profile credentials

The virtual appliance is not on EC2, has no instance profile, or the IMDSv2 hop limit is below 2.

STS rejected the AssumeRole request... MaxSessionDuration

Role Session Duration (seconds) exceeds the target role's Maximum session duration.

Resolution - Lower the field or raise the role's limit.

S3 403 Forbidden - access denied

The assumed role lacks s3:GetObject on the object, or a bucket policy blocks it.

The KDC returned an error for the service ticket request, and the error itself could not be read

The service ticket is too large for UDP and the KDC is requesting a retry over TCP, which the connector cannot process. Less often, cifs/<host> is not a recognized service principal.

Resolution - Set udp_preference_limit = 1 under [libdefaults] in the Kerberos configuration file on the virtual appliance. If the error persists, confirm the service principal with kvno cifs/<fully-qualified-host-name>. For more information, refer to Prerequisites.

Kerberos cannot locate a KDC for the realm

The Kerberos configuration file in use has no entry for the realm, or the connector did not find the file you placed on the virtual appliance and fell back to the default Java location.

Resolution - Add the realm and its KDC to the [realms] section of the Kerberos configuration file, and confirm the file is in the directory configured in Kerberos Configuration Directory. The connector logs which configuration file it used at the start of each connection.

The KDC has no service principal for this server

No cifs/ or HOST/ service principal is registered for the host name in use, or Host is set to an IP address or an alias.

Resolution - Set Host to the fully qualified name registered in Active Directory or Samba. On Windows, confirm the service principal with setspn -Q cifs/<fully-qualified-host-name>.

Kerberos rejected the login because the clocks are too far apart

The virtual appliance and KDC clocks differ by more than the realm's tolerance, which is five minutes by default.

Resolution - Synchronize the virtual appliance clock with the KDC.

Kerberos does not recognize the service account. Verify the username and that the realm is correct and spelled in upper case.

The service account does not exist in the realm, or Username and Kerberos Realm combine into the wrong principal.

Resolution - Correct Username or Kerberos Realm. The message names the principal that was attempted.

Pre-authentication information was invalid

The service account password is incorrect.

Resolution - Correct the Password.

The KDC and the VA share no common Kerberos encryption type. Enable AES on the service account.

The account and KDC have no common Kerberos encryption type.

Resolution - Enable the AES128 and AES256 Kerberos encryption types on the Active Directory user.

The server did not offer Kerberos during SMB negotiation

The share accepts only NTLM, or the Windows server is in a workgroup.

Resolution - Enable Kerberos on the share, and join or promote the Windows server into a domain. The connector does not fall back to NTLM.

SMB share '<share>' on <host> is not a disk share, so files cannot be read from it. Configure a file share.

Share Name is set to an administrative or printer share, such as IPC$.

Resolution - Set Share Name to a disk share.

The SMB server does not publish a share by that name. Verify the share name.

The share name does not exist on the server.

Resolution - Correct Share Name. Enter the share name only, without the server name or leading backslashes. On Windows, confirm the name with Get-SmbShare.

The SMB server authenticated the service account but denied access. Grant the account read permission on the share and on the file.

The service account authenticated, but it lacks permission on the share or the file.

Resolution - Grant the service account Read permission on the share ACL and on the NTFS folder and file.

Ensure there is valid data present in file

The SMB share served a header-only or stale file after Test Connection opened the file.

Resolution - Confirm that the share path is the folder that contains the data file, and that the file size on the share matches the file size on the file server. On Windows, confirm the path with Get-SmbShare.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.