# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Account Aggregation Fails

**Issue**: The account aggregation may fail due to insufficient permissions or if required services are not turned on.

**Resolution**: To test a GET user (read) using an Admin SDK Directory API from a browser, use the following URL, but replace `<userEmail>` and `<accessToken>` values:

```text
https://www.googleapis.com/admin/directory/v1/users/<userEmail>?access_token=<accessToken>
```

## Entitlement Aggregation Fails

**Issue**: The entitlement aggregation fails due to insufficient permissions or if required services are not turned on.

**Resolution**: To test a GET group (read) using an Admin SDK Directory API from a browser, use the following URL, but replace the `<groupEmail>` and `<accessToken>` values:

```text
https://www.googleapis.com/admin/directory/v1/groups/<groupEmail>?access_token=<accessToken>
```

To test a GET group (read) using the Google Groups Settings API (Read Group Details - Y) from a browser, use the following URL but replace the `<groupEmail>` and `<accessToken>` values:

```text
https://www.googleapis.com/groups/v1/groups/<groupEmail>?access_token=<accessToken>
```

## Internal Server and Service Unavailable Error

**Issue**: The Internal Server and Service Unavailable error messages are sent by the Google Server.

**Resolution**: To retry the request, use the `maxReadRetryCount` attribute. The retry count is set to 5 by default. Retry is performed using the standard Exponential Backoff strategy. Increase the retry count by adding the `maxReadRetryCount` attribute with the REST API:

- **key** - `connector_maxReadRetryCount`
- **value** - enter the number of retry options, for example, 10

## Poor Aggregation Performance

**Resolution**: For the Google Workspace source, the performance of account aggregation and entitlement aggregation can be improved by deleting the following schema attributes:

- `delegatedAdmins`
- `MANAGERS`
- `OWNERS`

The `MANAGERS` and `OWNERS` attributes must be deleted in combination. Deleting the `MANAGERS` or `OWNERS` attribute alone does not improve performance.

## Entitlements Do Not Display Friendly Names

**Issue**: During the initial account aggregation, any entitlement associated with the accounts is aggregated as a unique identifier.

**Resolution**: Configure and perform an entitlement aggregation to bring in the friendly entitlement names.

## The Create Account Operation Fails Because of a Time Delay to Provide Account Details Through the APIs

**Issue**: The following errors are encountered:

```text
error code 412 "User creation is not complete"
error code 404 "Object not found"
```

**Resolution**: Add the `createAccountTimelag` attribute in the connector. This attribute introduces a delay (default 0 seconds) after the Account Create operation so that subsequent operations such as assigning groups, aliases, and GET Object will not encounter errors. Add the `createAccountTimelag` attribute with a value of 20 seconds using the REST APIs.

Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>).

## 403 Error - Not Authorized to Access This Resource/API During Create Account Operation

**Resolution**: Ensure that the domain name of the primary email of the user being created contains the correct domain name across which a set of credentials are created. Also ensure the domain name is configured the same as the domain in the application configuration.

## Account Aggregation Fails With an Object Not Found Error Message

**Issue**: Account aggregation fails with the following error message:

```text
ObjectNotFoundException ] [ Error details ] Service Account iteration failed. Error: 404 null : Requested entity was not found.
```

**Resolution**: By adding the `serviceAccountAggWithAssetInventory` attribute to the source, API calls to aggregate service accounts are executed through the Asset Inventory API instead of the service account List API (which, by default, also tries to fetch service accounts from deleted projects/folders). The downside is that the service account description and disabled attributes are not provided by the Asset Inventory API.

Add the following using the REST APIs:

```text
curl --location --request PATCH 'https://<orgName>.api.cloud.sailpoint.com/v3/sources/{source ID}' \
--header 'Content-Type: application/json-patch+json' \
--header 'Authorization: Bearer tokenValue' \
--data-raw '[
 {
 "op": "add",
 "path": "/connectorAttributes/serviceAccountAggWithAssetInventory",
 "value": true
 }
]'
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Google Cloud Asset Aggregation Fails With "Permission Denied" (403)

**Issue**: Account aggregation fails with the error:

```text
Failed to preload IAM Policy, Error: 403 null: The caller does not have permission.
```

This error typically occurs when the connector attempts to call the `searchAllIamPolicies` API, specifically when querying for domain resources. The API endpoint referenced in error:

```text
https://cloudasset.googleapis.com/v1/organizations/672370982061:searchAllIamPolicies?query=resource:(cloudresourcemanager OR iam) AND policy:("user:" OR "serviceAccount:" OR "domain:")
```

By default, the connector attempts to retrieve cloud resources for service accounts, users, and domains. Aggregating domain resources requires additional Google Cloud scopes and permissions that may not be configured.

**Resolution**: If domain management or aggregation is not necessary for your use case, you can disable domain aggregation to resolve the permission error. To do this, add the `gcpAccountTypes` attribute to your source configuration via the REST API. For example:

```text
[
    {
        "op": "add",
        "path": "/connectorAttributes/gcpAccountTypes",
        "value": ["serviceAccount", "user"]
    }
]
```

> [!NOTE]
>
> If domain aggregation is required, ensure that the necessary additional scopes and permissions are granted to the connector's service account or identity. Refer to [Service Account Scopes and Built-In Roles for an Impersonated User](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/built_in_role_permissions.html#service-account-scopes-and-built-in-roles-for-an-impersonated-user>) for the specific permissions needed to aggregate domain resources.