# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Accounts Are Being Aggregated During the Entitlements Aggregation Process, or Entitlements Are Not Being Aggregated Correctly

**Resolution** - Verify the `searchDNs` configuration. In both cases, define `group.searchDNs` based on your specific group schema object types. For example, if your application uses three group schema types, `sudoRole`, `posixGroup`, and `group`, configure accordingly.

Configure three separate `group.searchDNs` entries, one for each group object type:

```xml
<entry key="sudpRole.searchDNs">
  <value>
    <List>
      <Map>
        <entry key="iterateSearchFilter" value="(objectClass=sudpRole)"/>
        <entry key="objectType" value="sudpRole"/>
        <entry key="searchDN" value="ou=sudpRole,dc=org,dc=com"/>
      </Map>
    </List>
  </value>
</entry>
<entry key="posixgroup.searchDNs">
  <value>
    <List>
      <Map>
        <entry key="iterateSearchFilter" value="(objectClass=posixgroup)"/>
        <entry key="objectType" value="posixgroups"/>
        <entry key="searchDN" value="ou=posixgroups,dc=org,dc=com"/>
      </Map>
    </List>
  </value>
</entry>
<entry key="group.searchDNs">
  <value>
    <List>
      <Map>
        <entry key="iterateSearchFilter" value="(objectClass=group)"/>
        <entry key="objectType" value="group"/>
        <entry key="searchDN" value="ou=group,dc=org,dc=com"/>
      </Map>
    </List>
  </value>
</entry>
```

## LDAP Source Delta Aggregation Deleting Accounts During Account Aggregation

**Resolution** - For the LDAP Connector, the default `objectClass` is defined as `inetOrgPerson` and this is not expected to be changed. Check if `inetOrgPerson` is present as `objectclass` property on the User object on the LDAP target system. If not, add it manually.

## LDAP Account Unlock Operation Fails with an Error Stating That `unlockAttr` Value Is Null

Error message example:

```text
2022-12-09T13:14:09,786 ERROR https-jsse-nio-8443-exec-1 sailpoint.connector.LDAPConnector:10387 - 1034091406 Failed to unlock Account[uid=NQTest01,ou=people,ou=workforce,dc=telefonica,dc=de]: Required String attribute : unlockAttr value was null. It must have a valid value. sailpoint.tools.GeneralException: Required String attribute : unlockAttr value was null. It must have a valid value.
```

**Resolution** - Add the following entry keys to the source configuration:

```xml
<entry key="lockAttr" value="nameofAttribute"/>
<entry key="lockVal" value="TRUE"/>
<entry key="unlockAttr" value="nameofAttribute"/>
<entry key="unlockVal" value="TRUE"/>
<entry key="unlockAction" value="replace"/>
```

## Create Account Operation Fails While Using Recommended Mappings in the Account Policy

The create account operation fails even though the recommended attribute mappings are used in the Account Policy.

**Resolution** - Ensure that the managed system is enabled to set the account attributes used by the Account Policy, then try the Create account operation again.

## Group Membership Filtering Fails If the LDAP Schema Entitlement Attribute Name Matches the Target System's Attribute Name

During account aggregation, group membership filters fail if the account attribute name in the LDAP source schema matches the attribute name on the target system exactly (when marked as an entitlement). For example, if `sudoRoleMemberOf` is used in the schema and marked as an entitlement, the filter will not be applied.

**Resolution** - To ensure the group membership filter works correctly, define the attribute in the LDAP source schema with a unique name. For example, use `sudoRoleMemberOfGroup` while keeping it marked as an entitlement. This allows the filter to process the attribute during account aggregation.

## Entitlements Are Not Getting Aggregated from Multi-Group Schema Configuration

In a multi-group schema configuration, entitlements are only aggregating from a single location, or you are unable to define specific search DNs for different object types (such as `group` and `nrfRole`).

**Resolution** - To aggregate objects from different DNs, you must manually define the `searchDNs` for each specific object type using the SailPoint API.

> [!NOTE]
>
> For more information, refer to the [SailPoint API specifications](<https://developer.sailpoint.com/docs/api/v3>).

1. Identify the Source ID for your LDAP source.
2. Perform a PATCH request to the following endpoint:

   `PATCH /v3/sources/:id`
3. Use the following request body to replace the `searchDNs` for each object type (for example, `group.searchDNs` and `nrfRole.searchDNs`):

   > **Note**
   >
   > Ensure the `objectType` value in the JSON matches the schema type you are targeting to ensure the connector correctly identifies the objects during aggregation.

   ```json
   [
     {
       "op": "replace",
       "path": "/connectorAttributes/group.searchDNs",
       "value": [
         {
           "searchDN": "ou=OP1,dc=maxcrc,dc=com",
           "searchScope": "SUBTREE",
           "iterateSearchFilter": null,
           "objectType": "group"
         }
       ]
     }
   ]
   ```

   ```json
   [
     {
       "op": "replace",
       "path": "/connectorAttributes/nrfRole.searchDNs",
       "value": [
         {
           "searchDN": "ou=OP2,dc=maxcrc,dc=com",
           "searchScope": "SUBTREE",
           "iterateSearchFilter": null,
           "objectType": "group"
         }
       ]
     }
   ]
   ```