# Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). For more information, refer to the Active Directory Connector - FAQ and Troubleshooting document. ## Exchange Connection Fails with Certificate Revocation Error When attempting to connect to a Microsoft Exchange server, the operation fails with the following error message: ```text The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable ``` This error occurs when the client (such as an IQService machine) cannot access the Certificate Revocation List (CRL) distribution point specified in the SSL certificate. **Resolution**: Follow these steps to validate your configuration: - In your application configuration, verify that the ExchHost parameter is set to the complete FQDN of the Exchange server. - Confirm that the SSL certificate for the Exchange server has been correctly imported on the server running IQService. The certificate must be placed in the Trusted Root Certification Authorities folder. - The certificate's Subject Alternative Name (SAN) field must contain an entry that exactly matches the FQDN of the Exchange server. ## Authentication Error Error occurred while authentication user: `Xyz` ```text Unable to use PTA with SASL ``` **Resolution**: Check the UPN name being used. Kerberos Authentication requires `userPrincipalName` as the primary requirement, and due to differences in the domain for `userPrincipalName`, the PTA authentication is failing. You must use the correct domain. For example, if you have two domains: ```text Abc.com xyz.abc.com ``` and you want to perform PTA for users present at `xyz.abc.com`, the format should be `username@xyz.abc.com`. ## Referrals During Account Aggregation During account aggregation, you might see one of the following errors: ```text Referrals during account aggregation or aggregation leading to javax.naming.PartialResultException ``` OR ```text Get Object failed with javax.naming.PartialResultException ``` OR ```text Pass-through authentication taking a long time to authenticate ``` Referrals occur when a domain controller redirects client requests to other servers or domains that might contain the requested information. This can happen when the domain controller does not have the necessary information to complete the request. **Resolution**: To avoid getting referrals and improve the performance of the AD connector, use the SailPoint REST APIs: > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. 1. Set the `ldapExtendedControls` attribute with a value such as `sample_ldapExtendedControls_value`. Refer to [LDAP Extended Controls]() for more information. > **Note** > > You can set multiple LDAP extended controls using the `ldapExtendedControls` attribute. 2. Verify the following entry is configured in source configuration: ```json "ldapExtendedControls": ["1.2.840.113556.1.4.1339"] ``` ## Exchange Provisioning Error You may see the following error during exchange provisioning: ```text Errors returned from IQService: Connecting to remote server <> failed with the following error message: The WinRM client cannot process the request. Basic Authentication is currently disabled in the client configuration. Change the client configuration and try the request again. ``` **Resolution**: Complete the following: 1. Check whether the Windows Remote Management service is installed on both the IQService and exchange server machine, and the service is up and running. To validate this, open PowerShell as an administrator and execute the following commands, before exchange provisioning: ```powershell winrm qc winrm e winrm/config/listener ``` 2. Ensure that the internal firewall is turned off. 3. If the steps mentioned above are unable to resolve the error, complete the following for the exchange server: 1. Open a PowerShell prompt as an administrator and run: ```powershell winrm get winrm/config/client ``` 2. If the Basic auth is set to false, then run the following command to set it to true: ```powershell winrm set winrm/config/client/auth '@{Basic="true"}' ``` ## Create Account Operation Error Create Account operation fails with the following error: ```text Errors returned from IQService. Failed to update attributes. There is no such object on the server. ``` Although the account gets created on Active Directory, some attributes are not configured. **Resolution**: If the manager attribute is present in `AccountRequest` (of the provisioning plan), confirm that the value of this attribute contains the distinguished name of the manager, instead of the name strings. ## Create New Account or Set Password Operation Error Error message: ```text Error occurred while setting password for the account. Exception has been thrown by the target of an invocation. One or more input parameters are invalid. ``` The above issue is observed for the following versions of Microsoft Windows Servers: - Microsoft Windows Server 2016 - Microsoft Windows Server 2012 R2 with KB 4012219 installed - Microsoft Windows Server 2012 with KB 4012220 installed - Microsoft Windows Server 2008 R2 with KB 4012218 installed **Resolution**: Ensure that the following Local Security Policy is set to **Not Defined**, or if it is enabled then ensure that the Local Security Policy contains the service account which is configured on the Active Directory source: ```text Network access: Restrict clients allowed to make remote calls to SAM ``` For Local Security Policy, go to **Local Computer Policy \> Computer Configuration \> Windows Settings \> Security Settings \> Local Policies \> Security Options**. ## Delta Aggregation Error Active Directory source delta aggregation may fail with the following error: ```text javax.naming.NoPermissionException: [LDAP: error code 50 - 00002105: LdapErr: DSID-0C0909F1, comment: Error processing control, data 0, v2580; remaining name 'dc=XX,dc=XXX,dc=XXX' ``` **Resolution**: Add the 'replicating directory changes' permission on the service account. Alternatively, add the service account to a security group that has the 'replicating directory changes' permission. ## Organizational Units (OU) Child Objects Don't Update Following a Delta Aggregation If you make a change to an OU which contains accounts or groups, such as renaming or moving it, a delta aggregation doesn't pick up the changes. This is a limitation in Microsoft DirSync Control. Refer to [Polling for Changes Using the DirSync Control]() for more information. **Resolution**: Perform a full aggregation to capture the changes and update the child objects. You might have to do this regularly to ensure the data is up to date. ## PowerShell cmdlets Used for Exchange (Mail Contacts) and Skype Related Operations The following are the PowerShell cmdlets used by the Active Directory source: - For Exchange (Mail Contact): All provisioning operations are performed through IQService. Contacts are created using ADSI APIs, and are mail-enabled using the `Enable-MailContact` PowerShell cmdlet if `externalEmailAddress` is provided in the plan. Other cmdlets used for Contacts (cmdlets run remotely on the exchange server itself using WinRM) are as follows: - `Get-MailContact` - `Disable-MailContact` - `Set-MailContact` - Skype related operations: Skype cmdlets (all Skype cmdlets run locally on the IQService machine that requires administrative tools installed on the machine): - `Get-CsUser` - `Get-CsClientPinInfo` - `Set-CsUser` - `Move-CsUser` - `Enable-CsUser` - `Disable-CsUser` - `Set-CsClientPin` - `Lock-CsClientPin` - `Unlock-CsClientPin` - `Grant-Cs` - `Remove-Cs` The source user for provisioning of Exchange Server must be Remote Shell enabled. To enable Remote Shell for a user, set the `RemotePowerShellEnabled` parameter to `$True` on the `Set-User` cmdlet. For example, `Set-User UserName -RemotePowerShellEnabled $True`. ## Test Connection Error for TLS Test connection for the Active Directory source fails when TLS is on. **Resolution**: Ensure that the correct AD DC certificate has been imported in the VA certificates folder in case of SailPoint. Verify whether it is a valid certificate before putting it on the VA: Perform the test connection on port 636 for the intended certificate on an LDAP browser. If the test connection is successful for the SSL connection, it indicates that the certificate is from the correct domain, and you can import it in the certificate folder on the VA server. ## Account Aggregation Error Error message: ```text LDAP: error code 12 - 00000057: LdapErr: DSID-0C090AFA, comment: Error processing control error in Active Directory full account aggregation ``` **Resolution**: Complete the following: 1. Add the `disableSort` attribute using the SailPoint REST API. Set up the `disableSort` attribute with a value such as `true`. 2. Change the server order in the domain. If there is only one entry in the servers list, try adding some other servers present in the domain. This can be done on the UI by setting the **Servers** field, or by editing the "servers" element in the source XML as provided in the following example: ```xml Server1 Server2 ``` 3. Change the value of `pageSize` (if it is set to 100, change it to 1000 and vice versa) and verify the aggregation result. ## Password Change Error Active Directory Password change fails with the following error message: ```text Caught exception in bind for server ``` **Resolution**: Verify if the service account used in the source has the required permissions mentioned in the [Service Account Permissions]() section. ## Directory Service Attribute or Value Already Exists Error During Provisioning During provisioning, the following error occurs: ```text The specified directory service attribute or value already exists. ``` This error indicates that an attribute or value being provisioned already exists in the managed system. **Resolution**: Following are the steps to resolve the error: 1. Set `setAttributeLevelResult` to `true` (in the String value) in the source configuration. 2. Perform the provisioning again and check for the attribute that failed. 3. Identify the failed attribute in the provisioning result. 4. Add the identified failed attribute to the `provisionAttributesWithSetOperation` in the source configuration using the SailPoint REST APIs as shown below: ```json "provisionAttributesWithSetOperation": ["customAttribute1", "customAttribute2"] ``` For example, during a modify operation when attributes like `countryCode`, which are already present in the managed system with some default values, throws an error. In that case, add that attribute to the source configuration using the SailPoint REST APIs as shown below: ```json "provisionAttributesWithSetOperation": ["countryCode"] ``` Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint's REST APIs. 5. Perform the provisioning again to verify that the error has been resolved. ## Unable to Aggregate Objects from Other Domains in a Multi-Domain Active Directory Environment **Resolution**: Ensure that all the relevant domains are added to the domain settings configuration. This will enable the system to pull objects from all specified domains during the Account and Group aggregation processes. For more information, refer to [Domain Settings](). For example, if objects from a specific domain, such as `"dc=sde3t,dc=eix,dc=com"`, are not being aggregated, you need to add the corresponding domain configuration under the `domainSettings` key to the source XML. Here's an example of how to configure the domain details: ```json "domainSettings": [ { "password": "passWordvalue", "servers": [ "DNSNameofDC" ], "port": 654, "forestName": "eix.com", "authorizationType": "simple", "user": "domainName\\serviceAccount", "domainDN": "DC=domainName,DC=lab", "useSSL": true } ] ``` ## Provisioning Fails while Adding/Updating Exchange Attribute The following error appears while provisioning Exchange attributes: ```text Example: Caught exception in Modify for identity CN=[EXT_KPMG] Test Ad28,OU=EXTERNALS,OU=USERS,OU=PRESP,OU=ES,OU=BUILDINGS,DC=gestamp,DC=com. System.DirectoryServices.DirectoryServicesCOMException (0x8007300A): The specified directory service attribute or value does not exist. ``` This error occurs due to the misconfiguration of the Exchange settings. **Resolution**: Verify the debug level IQTrace logs. Ensure that the valid forest name is configured for `accountForestList` under [Exchange Settings](). For example, if a newly created user belongs to `DC=domainXYZ,DC=com`, the `accountForestList` should also contain the same forest name (such as `domainXYZ.com`). Here's an example showing how to configure this in the source XML: ```xml Forest2 domainXYZ.com ``` ## Changing the Domain of an Account via a PowerShell Script Within the Same AD Source Fails **Resolution**: Move/Rename operations are allowed within the same domain only. ## Provisioning Error While Using a Non domain Joined IQService The following error appears when using a non-domain-joined IQService during provisioning: ```text Caught exception in getting current schema. Will Continue...Current security context is not associated with an Active Directory domain or forest," Active Directory schema validation is failing. ``` **Resolution**: Add the `skipADSchemaCheck` attribute with a value of `true` to skip Active Directory schema validation during provisioning. For example, set `"skipADSchemaCheck": true` in the source configuration. ## AcceptSecurityContext Fails with Error Code 49 The following error occurs if the user account is a member of the Protected Users security group. ```text LDAP: error code 49 AcceptSecurityContext ``` By default, membership in this group applies strict, non-configurable security protections to the account. **Resolution**: To resolve this issue, remove the account from the Protected Users group. ## IQService Fails to Start, Restart, or Establish a Connection If you experience one or more of the following issues with IQService: - The IQService stops unexpectedly during operation. - The IQService fails to restart when prompted. - Client connections fail with a TLS handshake error. - Operations cannot be completed due to a permissions issue. - The IQService reports that it failed to create a session. These symptoms often indicate that the account running the service lacks the necessary privileges to operate correctly on the server. **Resolution**: To resolve these issues, change the IQService logon account to the Local System account, and then restart the service. ## User is Trying to Reset a Password Using SET Operation in Admin Context **Resolution**: To set a password in admin context, you must include the `preExpire` attribute with a value of `true` within the password change request in the provisioning plan. The following is an example of a provisioning plan: ```xml true ``` ## DC Zone Name Contains an Underscore (\_) **Resolution**: 1. Open Ethernet properties and go to: **TCP/IPv4 Settings \> Advanced \> WINS** tab. 2. Select **Enable NetBIOS over TCP/IP**. 3. Configure the IP address in the domain settings. ## Provisioning Fails with the Error "Failed to update attribute externalEmailAddress." The following error occurs during provisioning when Exchange Settings are configured as Enable-MailUser using the `externalEmailAddress` attribute: ```text Failed to update attribute externalEmailAddress The specified directory service attribute or value does not exist ``` **Resolution**: Use the `targetAddress` attribute instead of `externalEmailAddress` in your provisioning configuration. Because `externalEmailAddress` is only a display name in the Exchange UI, the AD connector requires the internal LDAP attribute, which is `targetAddress`. ## Test Connection Error with Unknown Host While configuring an Active Directory source, you might see the following error: ```text Detected password less authentication, but failed to retrieve passwords with error: Unknown Host ``` **Resolution**: On the virtual appliance, run the following command to confirm that the virtual appliance can connect to IQService: ```powershell nslookup ``` ## Partial Account Created During Provisioning Triggers Another Create Operation A partial account might be created when provisioning fails for some attributes. The connector then attempts to create the account again. **Resolution**: Set the `rollbackCreatedAccountOnError` attribute to `true` so the connector removes the newly created account when the provisioning flow fails for some attributes. ```json [ { "op": "add", "path": "/connectorAttributes/rollbackCreatedAccountOnError", "value": true } ] ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. Refer to [Additional Configuration Parameters]() for more information. ## Accounts Dropped from Aggregation and Re-Added on Subsequent Runs Accounts might be dropped from aggregation and then re-added on subsequent aggregation runs. **Resolution**: Increase the `healthCheckTimeout` value in the source configuration using the SailPoint REST API. For example, set the value to 600: Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint's REST APIs. ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 600 } ] ``` If increasing `healthCheckTimeout` does not resolve the issue, remove `PREFER_UUID` from the `featuresString` attribute. Preserve other features already configured on the source. For example: ```json [ { "op": "replace", "path": "/connectorAttributes/featuresString", "value": "AUTHENTICATE, ENABLE, MANAGER_LOOKUP, SEARCH, UNLOCK, UNSTRUCTURED_TARGETS, GROUP_PROVISIONING, SYNC_PROVISIONING, PASSWORD, CURRENT_PASSWORD, GROUPS_HAVE_MEMBERS, NO_PERMISSIONS_PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING, DELETE" } ] ```