# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Test Connection Failures with OAuth 2.0 Authentication

While performing a test connection, it fails with following errors:

- The following error message displays:

  `[ InvalidRequestException ] [ Error details ] Request execution failed. HTTP Error code : 400, Okta Error code : invalid_client, errorSummary : Invalid value for 'client_id' parameter., errorCauses:[].`

  Resolution - Ensure that the **Issuer** is correct and it is the same as the **Client ID** of the service application created in Okta.
- The following error message displays:

  `[ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The subject claim for client_assertion is not a valid client_id., errorCauses:[].`

  Resolution - Ensure that the **Subject** is correct and it is the same as the **Client ID** of the service application created in Okta.
- The following error message displays:

  `[ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The audience claim for client_assertion must be the endpoint invoked for the request., errorCauses:[].`

  Resolution - Ensure that the URL provided in **Audience** is correct for authorization.
- The following error message displays:

  `[ InvalidConfigurationException ] Failed to decrypt the private key. class org.bouncycastle.asn1.pkcs.PrivateKeyInfo cannot be cast to class org.bouncycastle.openssl.PEMKeyPair`

  Resolution - The private key must be in PKCS\#1 format. Confirm that the first line of the private key is `-----BEGIN RSA PRIVATE KEY-----`. A key that begins with `-----BEGIN PRIVATE KEY-----` is PKCS\#8 and is not supported. For generation and conversion commands, refer to [Authenticate with OAuth 2.0](<https://documentation.sailpoint.com/connectors/discovery/sso/okta_sso/help/connecting.html#authenticate-with-oauth-20>).

## Operations Failed with an Error Message

While performing any operation with OAuth 2.0 Authentication Type, it fails with the following error message:

`[ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 403, Okta Error code : , errorSummary : , errorCauses:[].`

Resolution - Ensure that the appropriate scopes are provided to the Okta service application and the same are provided in the `scope` configuration parameter.

## Test Connection Failing with Error Message

When performing a test connection, it fails and the following error displays:

`Exception: sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Possible suggestions ] a) Make sure Okta instance is reachable. b) Make sure there is a smooth connectivity between Identity Server and Okta instance. [ Error details ] Failed to connect to the Okta instance.`

If there is a firewall between SailPoint and the Okta tenant, it is likely causing the blocking the connection.

Resolution - Verify if there are any firewall rules present in your environment that are blocking the Okta URL, FQDN, or IP address. If the rules are blocking this communication, unblock them.