Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.

For more information, refer to the Active Directory Connector - FAQ and Troubleshooting document.

Exchange Connection Fails with Certificate Revocation Error

When attempting to connect to a Microsoft Exchange server, the operation fails with the following error message:

The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable

This error occurs when the client (such as an IQService machine) cannot access the Certificate Revocation List (CRL) distribution point specified in the SSL certificate.

Resolution: Follow these steps to validate your configuration:

In your application configuration, verify that the ExchHost parameter is set to the complete FQDN of the Exchange server.
Confirm that the SSL certificate for the Exchange server has been correctly imported on the server running IQService. The certificate must be placed in the Trusted Root Certification Authorities folder.
The certificate's Subject Alternative Name (SAN) field must contain an entry that exactly matches the FQDN of the Exchange server.

Authentication Error

Error occurred while authentication user: Xyz

Unable to use PTA with SASL

Resolution: Check the UPN name being used.

Kerberos Authentication requires userPrincipalName as the primary requirement, and due to differences in the domain for userPrincipalName, the PTA authentication is failing. You must use the correct domain.

For example, if you have two domains:

Abc.com
xyz.abc.com

and you want to perform PTA for users present at xyz.abc.com, the format should be username@xyz.abc.com.

Referrals During Account Aggregation

During account aggregation, you might see one of the following errors:

Referrals during account aggregation or aggregation leading to javax.naming.PartialResultException

OR

Get Object failed with javax.naming.PartialResultException

OR

Pass-through authentication taking a long time to authenticate

Referrals occur when a domain controller redirects client requests to other servers or domains that might contain the requested information. This can happen when the domain controller does not have the necessary information to complete the request.

Resolution: To avoid getting referrals and improve the performance of the AD connector, use the SailPoint REST APIs:

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Set the ldapExtendedControls attribute with a value such as sample_ldapExtendedControls_value. Refer to LDAP Extended Controls for more information.

Note

You can set multiple LDAP extended controls using the ldapExtendedControls attribute.
Verify the following entry is configured in source configuration:
```
"ldapExtendedControls": ["1.2.840.113556.1.4.1339"]
```

Exchange Provisioning Error

You may see the following error during exchange provisioning:

Errors returned from IQService: Connecting to remote server <<Exchange HostName>> failed with the following error message: The WinRM client cannot process the request. Basic Authentication is currently disabled in the client configuration. Change the client configuration and try the request again.

Resolution: Complete the following:

Check whether the Windows Remote Management service is installed on both the IQService and exchange server machine, and the service is up and running. To validate this, open PowerShell as an administrator and execute the following commands, before exchange provisioning:
```
winrm qc
winrm e winrm/config/listener
```
Ensure that the internal firewall is turned off.
If the steps mentioned above are unable to resolve the error, complete the following for the exchange server:
1. Open a PowerShell prompt as an administrator and run:
```
winrm get winrm/config/client
```
2. If the Basic auth is set to false, then run the following command to set it to true:
```
winrm set winrm/config/client/auth '@{Basic="true"}'
```

Create Account Operation Error

Create Account operation fails with the following error:

Errors returned from IQService. Failed to update attributes. There is no such object on the server.

Although the account gets created on Active Directory, some attributes are not configured.

Resolution: If the manager attribute is present in AccountRequest (of the provisioning plan), confirm that the value of this attribute contains the distinguished name of the manager, instead of the name strings.

Create New Account or Set Password Operation Error

Error message:

Error occurred while setting password for the account. Exception has been thrown by the target of an invocation. One or more input parameters are invalid.

The above issue is observed for the following versions of Microsoft Windows Servers:

Microsoft Windows Server 2016
Microsoft Windows Server 2012 R2 with KB 4012219 installed
Microsoft Windows Server 2012 with KB 4012220 installed
Microsoft Windows Server 2008 R2 with KB 4012218 installed

Resolution: Ensure that the following Local Security Policy is set to Not Defined, or if it is enabled then ensure that the Local Security Policy contains the service account which is configured on the Active Directory source:

Network access: Restrict clients allowed to make remote calls to SAM

For Local Security Policy, go to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.

Delta Aggregation Error

Active Directory source delta aggregation may fail with the following error:

javax.naming.NoPermissionException: [LDAP: error code 50 - 00002105: LdapErr: DSID-0C0909F1, comment: Error processing control, data 0, v2580; remaining name 'dc=XX,dc=XXX,dc=XXX'

Resolution: Add the 'replicating directory changes' permission on the service account. Alternatively, add the service account to a security group that has the 'replicating directory changes' permission.

Organizational Units (OU) Child Objects Don't Update Following a Delta Aggregation

If you make a change to an OU which contains accounts or groups, such as renaming or moving it, a delta aggregation doesn't pick up the changes. This is a limitation in Microsoft DirSync Control. Refer to Polling for Changes Using the DirSync Control for more information.

Resolution: Perform a full aggregation to capture the changes and update the child objects. You might have to do this regularly to ensure the data is up to date.

The following are the PowerShell cmdlets used by the Active Directory source:

For Exchange (Mail Contact): All provisioning operations are performed through IQService. Contacts are created using ADSI APIs, and are mail-enabled using the Enable-MailContact PowerShell cmdlet if externalEmailAddress is provided in the plan.

Other cmdlets used for Contacts (cmdlets run remotely on the exchange server itself using WinRM) are as follows:
Get-MailContact
Disable-MailContact
Set-MailContact
Skype related operations: Skype cmdlets (all Skype cmdlets run locally on the IQService machine that requires administrative tools installed on the machine):
Get-CsUser
Get-CsClientPinInfo
Set-CsUser
Move-CsUser
Enable-CsUser
Disable-CsUser
Set-CsClientPin
Lock-CsClientPin
Unlock-CsClientPin
Grant-Cs<PolicyType>
Remove-Cs<PolicyType>

The source user for provisioning of Exchange Server must be Remote Shell enabled. To enable Remote Shell for a user, set the RemotePowerShellEnabled parameter to $True on the Set-User cmdlet. For example, Set-User UserName -RemotePowerShellEnabled $True.

Test Connection Error for TLS

Test connection for the Active Directory source fails when TLS is on.

Resolution: Ensure that the correct AD DC certificate has been imported in the VA certificates folder in case of SailPoint. Verify whether it is a valid certificate before putting it on the VA:

Perform the test connection on port 636 for the intended certificate on an LDAP browser. If the test connection is successful for the SSL connection, it indicates that the certificate is from the correct domain, and you can import it in the certificate folder on the VA server.

Account Aggregation Error

Error message:

LDAP: error code 12 - 00000057: LdapErr: DSID-0C090AFA, comment: Error processing control error in Active Directory full account aggregation

Resolution: Complete the following:

Add the disableSort attribute using the SailPoint REST API. Set up the disableSort attribute with a value such as true.
Change the server order in the domain. If there is only one entry in the servers list, try adding some other servers present in the domain. This can be done on the UI by setting the Servers field, or by editing the "servers" element in the source XML as provided in the following example:
```
<entry key="servers">
    <value>
        <List>
            <String>Server1</String>
            <String>Server2</String>
        </List>
    </value>
</entry>
```
Change the value of pageSize (if it is set to 100, change it to 1000 and vice versa) and verify the aggregation result.

Password Change Error

Active Directory Password change fails with the following error message:

Caught exception in bind for server

Resolution: Verify if the service account used in the source has the required permissions mentioned in the Service Account Permissions section.

Directory Service Attribute or Value Already Exists Error During Provisioning

During provisioning, the following error occurs:

The specified directory service attribute or value already exists.

This error indicates that an attribute or value being provisioned already exists in the managed system.

Resolution: Following are the steps to resolve the error:

Set setAttributeLevelResult to true (in the String value) in the source configuration.
Perform the provisioning again and check for the attribute that failed.
Identify the failed attribute in the provisioning result.
Add the identified failed attribute to the provisionAttributesWithSetOperation in the source configuration using the SailPoint REST APIs as shown below:
```
"provisionAttributesWithSetOperation": ["customAttribute1", "customAttribute2"]
```
For example, during a modify operation when attributes like countryCode, which are already present in the managed system with some default values, throws an error. In that case, add that attribute to the source configuration using the SailPoint REST APIs as shown below:
```
"provisionAttributesWithSetOperation": ["countryCode"]
```
Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community for more information on SailPoint's REST APIs.
Perform the provisioning again to verify that the error has been resolved.

Unable to Aggregate Objects from Other Domains in a Multi-Domain Active Directory Environment

Resolution: Ensure that all the relevant domains are added to the domain settings configuration. This will enable the system to pull objects from all specified domains during the Account and Group aggregation processes. For more information, refer to Domain Settings.

For example, if objects from a specific domain, such as "dc=sde3t,dc=eix,dc=com", are not being aggregated, you need to add the corresponding domain configuration under the domainSettings key to the source XML. Here's an example of how to configure the domain details:

"domainSettings": [
  {
    "password": "passWordvalue",
    "servers": [
      "DNSNameofDC"
    ],
    "port": 654,
    "forestName": "eix.com",
    "authorizationType": "simple",
    "user": "domainName\\serviceAccount",
    "domainDN": "DC=domainName,DC=lab",
    "useSSL": true
  }
]

Provisioning Fails while Adding/Updating Exchange Attribute

The following error appears while provisioning Exchange attributes:

Example: <AttributeRequest name="exch_externalEmailAddress" op="Add" value="SMTP:DEVtest.xxxx@gestamp.com"/>
Caught exception in Modify for identity CN=[EXT_KPMG] Test Ad28,OU=EXTERNALS,OU=USERS,OU=PRESP,OU=ES,OU=BUILDINGS,DC=gestamp,DC=com.
System.DirectoryServices.DirectoryServicesCOMException (0x8007300A): The specified directory service attribute or value does not exist.

This error occurs due to the misconfiguration of the Exchange settings.

Resolution: Verify the debug level IQTrace logs. Ensure that the valid forest name is configured for accountForestList under Exchange Settings.

For example, if a newly created user belongs to DC=domainXYZ,DC=com, the accountForestList should also contain the same forest name (such as domainXYZ.com). Here's an example showing how to configure this in the source XML:

<entry key="accountForestList">
    <value>
        <List>
            <String>Forest2</String>
            <String>domainXYZ.com</String>
        </List>
    </value>
</entry>

Changing the Domain of an Account via a PowerShell Script Within the Same AD Source Fails

Resolution: Move/Rename operations are allowed within the same domain only.

Provisioning Error While Using a Non domain Joined IQService

The following error appears when using a non-domain-joined IQService during provisioning:

Caught exception in getting current schema. Will Continue...Current security context is not associated with an Active Directory domain or forest," Active Directory schema validation is failing.

Resolution: Add the skipADSchemaCheck attribute with a value of true to skip Active Directory schema validation during provisioning.

For example, set "skipADSchemaCheck": true in the source configuration.

AcceptSecurityContext Fails with Error Code 49

The following error occurs if the user account is a member of the Protected Users security group.

LDAP: error code 49 AcceptSecurityContext

By default, membership in this group applies strict, non-configurable security protections to the account.

Resolution: To resolve this issue, remove the account from the Protected Users group.

IQService Fails to Start, Restart, or Establish a Connection

If you experience one or more of the following issues with IQService:

The IQService stops unexpectedly during operation.
The IQService fails to restart when prompted.
Client connections fail with a TLS handshake error.
Operations cannot be completed due to a permissions issue.
The IQService reports that it failed to create a session.

These symptoms often indicate that the account running the service lacks the necessary privileges to operate correctly on the server.

Resolution: To resolve these issues, change the IQService logon account to the Local System account, and then restart the service.

User is Trying to Reset a Password Using SET Operation in Admin Context

Resolution: To set a password in admin context, you must include the preExpire attribute with a value of true within the password change request in the provisioning plan. The following is an example of a provisioning plan:

<AttributeRequest name="password" op="Set" value="NewPassword123">
<Attributes>
<Map>
<entry key="preExpire">
<value><Boolean>true</Boolean></value>
</entry>
</Map>
</Attributes>
</AttributeRequest>

DC Zone Name Contains an Underscore (_)

Resolution:

Open Ethernet properties and go to: TCP/IPv4 Settings > Advanced > WINS tab.
Select Enable NetBIOS over TCP/IP.
Configure the IP address in the domain settings.

Provisioning Fails with the Error "Failed to update attribute externalEmailAddress."

The following error occurs during provisioning when Exchange Settings are configured as Enable-MailUser using the externalEmailAddress attribute:

Failed to update attribute externalEmailAddress The specified directory service attribute or value does not exist

Resolution: Use the targetAddress attribute instead of externalEmailAddress in your provisioning configuration.

Because externalEmailAddress is only a display name in the Exchange UI, the AD connector requires the internal LDAP attribute, which is targetAddress.

Test Connection Error with Unknown Host

While configuring an Active Directory source, you might see the following error:

Detected password less authentication, but failed to retrieve passwords with error: Unknown Host <Host_Name>

Resolution: On the virtual appliance, run the following command to confirm that the virtual appliance can connect to IQService:

nslookup <FQDN name of IQServiceHost>

Partial Account Created During Provisioning Triggers Another Create Operation

A partial account might be created when provisioning fails for some attributes. The connector then attempts to create the account again.

Resolution: Set the rollbackCreatedAccountOnError attribute to true so the connector removes the newly created account when the provisioning flow fails for some attributes.

[
  {
    "op": "add",
    "path": "/connectorAttributes/rollbackCreatedAccountOnError",
    "value": true
  }
]

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Refer to Additional Configuration Parameters for more information.

Accounts Dropped from Aggregation and Re-Added on Subsequent Runs

Accounts might be dropped from aggregation and then re-added on subsequent aggregation runs.

Resolution: Increase the healthCheckTimeout value in the source configuration using the SailPoint REST API. For example, set the value to 600:

Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community for more information on SailPoint's REST APIs.

[
  {
    "op": "replace",
    "path": "/connectorAttributes/healthCheckTimeout",
    "value": 600
  }
]

If increasing healthCheckTimeout does not resolve the issue, remove PREFER_UUID from the featuresString attribute. Preserve other features already configured on the source. For example:

[
  {
    "op": "replace",
    "path": "/connectorAttributes/featuresString",
    "value": "AUTHENTICATE, ENABLE, MANAGER_LOOKUP, SEARCH, UNLOCK, UNSTRUCTURED_TARGETS, GROUP_PROVISIONING, SYNC_PROVISIONING, PASSWORD, CURRENT_PASSWORD, GROUPS_HAVE_MEMBERS, NO_PERMISSIONS_PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING, DELETE"
  }
]

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.

Troubleshooting

Debug Logs

Exchange Connection Fails with Certificate Revocation Error

Authentication Error

Referrals During Account Aggregation

Exchange Provisioning Error

Create Account Operation Error

Create New Account or Set Password Operation Error

Delta Aggregation Error

Organizational Units (OU) Child Objects Don't Update Following a Delta Aggregation

PowerShell cmdlets Used for Exchange (Mail Contacts) and Skype Related Operations

Test Connection Error for TLS

Account Aggregation Error

Password Change Error

Directory Service Attribute or Value Already Exists Error During Provisioning

Unable to Aggregate Objects from Other Domains in a Multi-Domain Active Directory Environment

Provisioning Fails while Adding/Updating Exchange Attribute

Changing the Domain of an Account via a PowerShell Script Within the Same AD Source Fails

Provisioning Error While Using a Non domain Joined IQService

AcceptSecurityContext Fails with Error Code 49

IQService Fails to Start, Restart, or Establish a Connection

User is Trying to Reset a Password Using SET Operation in Admin Context

DC Zone Name Contains an Underscore (_)

Provisioning Fails with the Error "Failed to update attribute externalEmailAddress."

Test Connection Error with Unknown Host

Partial Account Created During Provisioning Triggers Another Create Operation

Accounts Dropped from Aggregation and Re-Added on Subsequent Runs

Documentation Feedback