Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Invalid Password

Invalid Password

Message is displayed when setting password/passphrase with 9 - 13 characters.

Resolution: Passphrase can be 9 - 100 characters if KDFAES or ICHPWX11 encryption algorithm is present on the server. If KDFAES or ICHPWX11 encryption algorithm is not present on the server then the allowed number of characters for passphrase are 14 - 100.

Self change password operation failure

[LDAP:error code 1 - R000208 Unexpected racroute error safRC=8 racfRC=36 racfReason=0(srv_authenticate_native_passsword:3567)]

Error occurs when performing a self change password operation for an account and one of the connections is revoked.

Resolution: For change password operation, connections of the accounts must not be revoked.

Create Account Failure

Failed to create account. Specifying default group is mandatory when more than one groups are requested.

When create account request has multiple groups and the default group is not mentioned then create account request fails.

Resolution: Ensure that the default group is specified. If Owner of the user account is not specified then default group of the user would be the owner of the user account.

Connection failure during any operation

[ConnectionFailedException] [Possible suggestions] a) Make sure there is a smooth connectivity between Identity Server and host. b) Ensure the host/end system is up and running. [Error details] Failed to connect to server: simple bind failed: <ip address>:<port>"

When there is a connection failure while performing any operation.

Resolution: Add the following entry in the catalina.bat (Tomcat) file and restart the application server.

set JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true

Usage of aggregateGroupDNInLowerCase

Case sensitivity discrepancies between user group memberships and group object names result in the creation of duplicate groups during account and entitlement aggregation.

Resolution: Use this setting if your target system uses inconsistent capitalization for group names (for example, a mix of uppercase and lowercase). This prevents the system from creating duplicate groups when it syncs data.

Note

If there is a case mismatch between the group names attached to users (via group membership) and the actual group objects, the system may create duplicate groups during account and entitlement aggregation.

To prevent duplicate groups, follow these steps:

  1. Reset the source (If this is not possible, we recommend NOT to use this configuration at all).
  2. In the source configuration, set aggregateGroupDNInLowerCase to true.
  3. Run Account Aggregation, and then run Entitlement Aggregation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.