Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Accounts Are Being Aggregated During the Entitlements Aggregation Process, or Entitlements Are Not Being Aggregated Correctly

Resolution - Verify the searchDNs configuration. In both cases, define group.searchDNs based on your specific group schema object types. For example, if your application uses three group schema types, sudoRole, posixGroup, and group, configure accordingly.

Configure three separate group.searchDNs entries, one for each group object type:

<entry key="sudpRole.searchDNs">
  <value>
    <List>
      <Map>
        <entry key="iterateSearchFilter" value="(objectClass=sudpRole)"/>
        <entry key="objectType" value="sudpRole"/>
        <entry key="searchDN" value="ou=sudpRole,dc=org,dc=com"/>
      </Map>
    </List>
  </value>
</entry>
<entry key="posixgroup.searchDNs">
  <value>
    <List>
      <Map>
        <entry key="iterateSearchFilter" value="(objectClass=posixgroup)"/>
        <entry key="objectType" value="posixgroups"/>
        <entry key="searchDN" value="ou=posixgroups,dc=org,dc=com"/>
      </Map>
    </List>
  </value>
</entry>
<entry key="group.searchDNs">
  <value>
    <List>
      <Map>
        <entry key="iterateSearchFilter" value="(objectClass=group)"/>
        <entry key="objectType" value="group"/>
        <entry key="searchDN" value="ou=group,dc=org,dc=com"/>
      </Map>
    </List>
  </value>
</entry>

LDAP Source Delta Aggregation Deleting Accounts During Account Aggregation

Resolution - For the LDAP Connector, the default objectClass is defined as inetOrgPerson and this is not expected to be changed. Check if inetOrgPerson is present as objectclass property on the User object on the LDAP target system. If not, add it manually.

LDAP Account Unlock Operation Fails with an Error Stating That unlockAttr Value Is Null

Error message example:

2022-12-09T13:14:09,786 ERROR https-jsse-nio-8443-exec-1 sailpoint.connector.LDAPConnector:10387 - 1034091406 Failed to unlock Account[uid=NQTest01,ou=people,ou=workforce,dc=telefonica,dc=de]: Required String attribute : unlockAttr value was null. It must have a valid value. sailpoint.tools.GeneralException: Required String attribute : unlockAttr value was null. It must have a valid value.

Resolution - Add the following entry keys to the source configuration:

<entry key="lockAttr" value="nameofAttribute"/>
<entry key="lockVal" value="TRUE"/>
<entry key="unlockAttr" value="nameofAttribute"/>
<entry key="unlockVal" value="TRUE"/>
<entry key="unlockAction" value="replace"/>

The create account operation fails even though the recommended attribute mappings are used in the Account Policy.

Resolution - Ensure that the managed system is enabled to set the account attributes used by the Account Policy, then try the Create account operation again.

Group Membership Filtering Fails If the LDAP Schema Entitlement Attribute Name Matches the Target System's Attribute Name

During account aggregation, group membership filters fail if the account attribute name in the LDAP source schema matches the attribute name on the target system exactly (when marked as an entitlement). For example, if sudoRoleMemberOf is used in the schema and marked as an entitlement, the filter will not be applied.

Resolution - To ensure the group membership filter works correctly, define the attribute in the LDAP source schema with a unique name. For example, use sudoRoleMemberOfGroup while keeping it marked as an entitlement. This allows the filter to process the attribute during account aggregation.

Entitlements Are Not Getting Aggregated from Multi-Group Schema Configuration

In a multi-group schema configuration, entitlements are only aggregating from a single location, or you are unable to define specific search DNs for different object types (such as group and nrfRole).

Resolution - To aggregate objects from different DNs, you must manually define the searchDNs for each specific object type using the SailPoint API.

Note

For more information, refer to the SailPoint API specifications.

  1. Identify the Source ID for your LDAP source.

  2. Perform a PATCH request to the following endpoint:

    PATCH /v3/sources/:id

  3. Use the following request body to replace the searchDNs for each object type (for example, group.searchDNs and nrfRole.searchDNs):

    Note

    Ensure the objectType value in the JSON matches the schema type you are targeting to ensure the connector correctly identifies the objects during aggregation.

    [
  {
    "op": "replace",
    "path": "/connectorAttributes/group.searchDNs",
    "value": [
      {
        "searchDN": "ou=OP1,dc=maxcrc,dc=com",
        "searchScope": "SUBTREE",
        "iterateSearchFilter": null,
        "objectType": "group"
      }
    ]
  }
]

    [
  {
    "op": "replace",
    "path": "/connectorAttributes/nrfRole.searchDNs",
    "value": [
      {
        "searchDN": "ou=OP2,dc=maxcrc,dc=com",
        "searchScope": "SUBTREE",
        "iterateSearchFilter": null,
        "objectType": "group"
      }
    ]
  }
]

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.