Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Account Aggregation Fails

Issue: The account aggregation may fail due to insufficient permissions or if required services are not turned on.

Resolution: To test a GET user (read) using an Admin SDK Directory API from a browser, use the following URL, but replace <userEmail> and <accessToken> values:

https://www.googleapis.com/admin/directory/v1/users/<userEmail>?access_token=<accessToken>

Entitlement Aggregation Fails

Issue: The entitlement aggregation fails due to insufficient permissions or if required services are not turned on.

Resolution: To test a GET group (read) using an Admin SDK Directory API from a browser, use the following URL, but replace the <groupEmail> and <accessToken> values:

https://www.googleapis.com/admin/directory/v1/groups/<groupEmail>?access_token=<accessToken>

To test a GET group (read) using the Google Groups Settings API (Read Group Details - Y) from a browser, use the following URL but replace the <groupEmail> and <accessToken> values:

https://www.googleapis.com/groups/v1/groups/<groupEmail>?access_token=<accessToken>

Internal Server and Service Unavailable Error

Issue: The Internal Server and Service Unavailable error messages are sent by the Google Server.

Resolution: To retry the request, use the maxReadRetryCount attribute. The retry count is set to 5 by default. Retry is performed using the standard Exponential Backoff strategy. Increase the retry count by adding the maxReadRetryCount attribute with the REST API:

key - connector_maxReadRetryCount
value - enter the number of retry options, for example, 10

Poor Aggregation Performance

Resolution: For the Google Workspace source, the performance of account aggregation and entitlement aggregation can be improved by deleting the following schema attributes:

delegatedAdmins
MANAGERS
OWNERS

The MANAGERS and OWNERS attributes must be deleted in combination. Deleting the MANAGERS or OWNERS attribute alone does not improve performance.

Entitlements Do Not Display Friendly Names

Issue: During the initial account aggregation, any entitlement associated with the accounts is aggregated as a unique identifier.

Resolution: Configure and perform an entitlement aggregation to bring in the friendly entitlement names.

The Create Account Operation Fails Because of a Time Delay to Provide Account Details Through the APIs

Issue: The following errors are encountered:

error code 412 "User creation is not complete"
error code 404 "Object not found"

Resolution: Add the createAccountTimelag attribute in the connector. This attribute introduces a delay (default 0 seconds) after the Account Create operation so that subsequent operations such as assigning groups, aliases, and GET Object will not encounter errors. Add the createAccountTimelag attribute with a value of 20 seconds using the REST APIs.

Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial).

403 Error - Not Authorized to Access This Resource/API During Create Account Operation

Resolution: Ensure that the domain name of the primary email of the user being created contains the correct domain name across which a set of credentials are created. Also ensure the domain name is configured the same as the domain in the application configuration.

Account Aggregation Fails With an Object Not Found Error Message

Issue: Account aggregation fails with the following error message:

ObjectNotFoundException ] [ Error details ] Service Account iteration failed. Error: 404 null : Requested entity was not found.

Resolution: By adding the serviceAccountAggWithAssetInventory attribute to the source, API calls to aggregate service accounts are executed through the Asset Inventory API instead of the service account List API (which, by default, also tries to fetch service accounts from deleted projects/folders). The downside is that the service account description and disabled attributes are not provided by the Asset Inventory API.

Add the following using the REST APIs:

curl --location --request PATCH 'https://<orgName>.api.cloud.sailpoint.com/v3/sources/{source ID}' \
--header 'Content-Type: application/json-patch+json' \
--header 'Authorization: Bearer tokenValue' \
--data-raw '[
 {
 "op": "add",
 "path": "/connectorAttributes/serviceAccountAggWithAssetInventory",
 "value": true
 }
]'

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Google Cloud Asset Aggregation Fails With "Permission Denied" (403)

Issue: Account aggregation fails with the error:

Failed to preload IAM Policy, Error: 403 null: The caller does not have permission.

This error typically occurs when the connector attempts to call the searchAllIamPolicies API, specifically when querying for domain resources. The API endpoint referenced in error:

https://cloudasset.googleapis.com/v1/organizations/672370982061:searchAllIamPolicies?query=resource:(cloudresourcemanager OR iam) AND policy:("user:" OR "serviceAccount:" OR "domain:")

By default, the connector attempts to retrieve cloud resources for service accounts, users, and domains. Aggregating domain resources requires additional Google Cloud scopes and permissions that may not be configured.

Resolution: If domain management or aggregation is not necessary for your use case, you can disable domain aggregation to resolve the permission error. To do this, add the gcpAccountTypes attribute to your source configuration via the REST API. For example:

[
    {
        "op": "add",
        "path": "/connectorAttributes/gcpAccountTypes",
        "value": ["serviceAccount", "user"]
    }
]

Note

If domain aggregation is required, ensure that the necessary additional scopes and permissions are granted to the connector's service account or identity. Refer to Service Account Scopes and Built-In Roles for an Impersonated User for the specific permissions needed to aggregate domain resources.

Delta Aggregation Takes a Long Time to Complete

Resolution: In delta aggregation, you get the changed user details using the audit change event API and then make a single API call per changed user, consuming more aggregation time. If there is a large number of changed users during delta aggregation, the delta aggregation time degrades. In this case, SailPoint recommends running full aggregation instead of delta aggregation.

For example, if full aggregation takes 4 hours to complete and delta aggregation with 4,000-6,000 users takes the same amount of time or longer, use full aggregation. If there are fewer changes and delta aggregation takes only 30 minutes, use delta aggregation.

Note

SailPoint recommends using delta aggregation based on your use case.

Failing to Generate an Access Token With the Service Account

Issue: You receive the following error message:

Ensure configuration details are correct. [ Error details ] Failed to generate access token with service account. class org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo cannot be cast to class org.bouncycastle.openssl.PEMKeyPair (org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo and org.bouncycastle.openssl.PEMKeyPair are in unnamed module of loader 'app')

Resolution: Verify the private key creation steps. Refer to Convert Service Account Private Key to RSA Format.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.