# Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Issues in Delta Aggregation The following are various scenarios where data is not populated in Delta Aggregation: - Roles assigned to an account from API are not populated in delta aggregation. Sometimes applications that are removed from users are not aggregated in account delta aggregation. **Resolution** - Perform full account aggregation task. - Sometimes groups that are deleted from the managed system are not captured in account delta aggregation. **Resolution** - Perform full group aggregation to refresh entitlements. - For an account created with only the default group **Everyone** event system logs are not captured. **Resolution** - To see the default group assigned to account, perform a full account aggregation or create account with a different group so that in delta aggregation for account, both groups details (default and the other group) are aggregated. - If the HELP\_DESK\_ADMIN role is removed from a user on the managed system, sometimes after delta aggregation `groupTargetHelpDeskAdminRole` is not removed. - If `groupTarget` is removed from user HELP\_DESK\_ADMIN role, sometimes changes are not reflected after delta aggregation **Resolution** - Perform full account aggregation task. - If APP\_ADMIN role is removed from a user on the managed system, sometimes after delta aggregation `applicationsManagedByRole` is not removed. - If `applicationsManagedByRole` is removed from user APP\_ADMIN role, sometimes changes are not reflected after delta aggregation. **Resolution** - Perform full account aggregation task. ## Delta aggregation processes account deletes regardless of Detect Deleted Delta aggregation processes account deletes even when **Detect Deleted** is not enabled. **Resolution** - As a workaround, add the following entry to the source XML using the REST APIs: ```json [ { "op": "add", "path": "/connectorAttributes/accountFilterAttribute", "value": "true" } ] ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Unlocked Okta Account Displays Incorrect Status For Unlocked Okta accounts, the account details might not display the correct status. This occurs when the managed account refresh action only affects the status of the account in SailPoint. Account details are not changed and `status` is one of the account attributes. **Resolution** - To get the correct account details and value of the **Account status**, then execute the account aggregation task. ## Create Account Fails for an Account Assigned to the 'Everyone' Group By default, on the Okta managed system the group **Everyone** gets assigned to every account created. Create account fails with following error message displayed: ```text sailpoint.connector.ConnectorException: [ConnectorException] [Error details] Request execution failed. HTTP Error code: 501, Okta Error code: E0000060, errorSummary: Unsupported operation., errorCauses:[]. ``` **Resolution** - While performing create account in **Access Profiles**, select a group type other than **Everyone**. ## While performing Account Aggregation warnings are displayed in the logs While performing account aggregation the following warnings are displayed in the logs: ```text 019-04-18 18:43:25,708 WARN Thread-743 openconnector.connector.okta.OktaConnector:5425 - API rate limit exceeded for endpoint, Retrying the failed request now 2019-04-18 18:43:25,709 WARN Thread-742 openconnector.connector.okta.OktaConnector:5425 - API rate limit exceeded for endpoint, Retrying the failed request now ``` **Resolution** - You may ignore the warning messages. But to improve Okta aggregation performance, increase the Okta API rate limit. ## While creating or updating primary email address of Okta user, it updates Username (login) as same email address While creating or updating the primary email address of Okta user, it updates their Username (login) as the same email address. Okta has a feature of self-service registration policy. When `SELF_SERVICE_REGISTRATION` is enabled on Okta managed system, Okta enforces uniqueness for all primary email addresses and automatically uses that email address as the end user's username (login) and primary email address. **Resolution** - Disable `SELF_SERVICE_REGISTRATION` in Okta managed system. For more information contact Okta Customer Support. ## Account Aggregation fails with an error message - The following error message displays: ```text Exception during aggregation of Object Type account on Application Okta. Reason: [ InvalidConfigurationException ] [ Possible suggestions ] Ensure the resource mentioned in the Okta URL is correct. The URL resource is /api/v1/groups//users?limit=10000 [ Error details ] Request execution failed. HTTP Error code : 405, Okta Error code : E0000022, errorSummary : The endpoint does not support the provided HTTP method, errorCauses:[] ``` **Resolution** - Due to the HTTP 405 response code from Okta instance, ensure that the Okta URL is correct and able to access the Okta resources. This issue occurs due to the vanity Okta URL (customized). Verify the correct settings with Okta team and allow the API response. - While performing account aggregation with the **OAuth 2.0** authentication type, aggregation fails with the following error message: ```text openconnector.ConnectorException: [ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 403, Okta Error code : E0000005, errorSummary : Invalid session, errorCauses:[]. ``` **Resolution** - If the `type_name` and `type_displayName` attributes are configured in the account schema, delete these attributes and perform the account aggregation. > **Note** > > Aggregation of `type_name` and `type_displayName` is only supported with the **API Token** authentication type. - The following error message displays: ```text Exception during aggregation of Object Type account on Application Okta. Reason: Unable to create iterator sailpoint.connector.InsufficientPermissionException: [InsufficientPermissionException] [Possible suggestions] Furnish appropriate permission to the Okta API token owner. [Error details] Insufficient privileges detected. HTTP Error code: 401, Okta Error code: E0000015, errorSummary: You do not have permission to access the feature you are requesting ``` **Resolution**: - Ensure that the correct permissions or roles are assigned to the API Owner (the user whose API token is used in the Okta application). The API Owner must have SUPER ADMIN roles assigned for aggregation. > **Note** > > To aggregate Okta roles, SUPER\_ADMIN role is required. - The **List Users with Search** parameter supports pagination (to a maximum of 50000 results). - Ensure you correctly set the **List Users with Search** attribute. ## Test Connection failures with OAuth 2.0 authentication While performing a test connection, it fails with following errors: - The following error message displays: ```text [ InvalidRequestException ] [ Error details ] Request execution failed. HTTP Error code : 400, Okta Error code : invalid_client, errorSummary : Invalid value for 'client_id' parameter., errorCauses:[]. ``` **Resolution** - Ensure that the **Client ID** is correct and it is the same as the **Client ID** of the service application created in Okta. - The following error message displays: ```text [ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The subject claim for client_assertion is not a valid client_id., errorCauses:[]. ``` **Resolution** - Ensure that the **Client ID** is correct and it is the same as the **Client ID** of the service application created in Okta. - The following error message displays: ```text [ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The audience claim for client_assertion must be the endpoint invoked for the request., errorCauses:[]. ``` **Resolution** - Ensure that the URL provided in **OAuth 2.0 Token URL** is correct for authorization. - The following error message displays: ```text [ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 401, Okta Error code : invalid_client, errorSummary : The client_assertion JWT kid is invalid., errorCauses:[]. ``` **Resolution** - If multiple keys are present in the Okta application, add the corresponding KID to the **JWT Header** field: ```json { "typ": "JWT", "alg": "RS256", "kid": "" } ``` - The following error message displays: ```text [ InvalidConfigurationException ] Failed to decrypt the private key. class org.bouncycastle.asn1.pkcs.PrivateKeyInfo cannot be cast to class org.bouncycastle.openssl.PEMKeyPair ``` **Resolution** - The private key must be in PKCS\#1 format. Confirm that the first line of the private key is `-----BEGIN RSA PRIVATE KEY-----`. A key that begins with `-----BEGIN PRIVATE KEY-----` is PKCS\#8 and is not supported. For generation and conversion commands, refer to [Authenticate with OAuth 2.0](). ## Operations failed with an error message While performing any operation with OAuth 2.0 Authentication Type, it fails with the following error message: ```text [ ConnectorException ] [ Error details ] Request execution failed. HTTP Error code : 403, Okta Error code : , errorSummary : , errorCauses:[]. ``` **Resolution** - Ensure that the appropriate scopes are provided to the Okta service application and the same are provided in the `scope` configuration parameter. ## Error while removing APP Target, App Instance Target, or Group Target from a User ```text [ InvalidConfigurationException ] [ Possible suggestions ] Ensure the resource mentioned in the Okta URL is correct. The URL resource is //api/v1/users/00u1jw6jffvr3GG395d7/roles/IFIFAX2BIRGUSTQ/targets/catalog/apps/hellofax [ Error details ] Request execution failed. HTTP Error code : 405, Okta Error code : E0000091, errorSummary : The provided role type was not the same as required role type., errorCauses:[]. [ InvalidConfigurationException ] [ Possible suggestions ] Ensure the resource mentioned in the Okta URL is correct. The URL resource is //api/v1/users/00u2on1gcpgu4gIc55d7/roles/JBCUYUC7IRCVGS27IFCE2SKO/targets/groups/00g2dyy3zoPvqGkvI5d7 [ Error details ] Request execution failed. HTTP Error code : 405, Okta Error code : E0000091, errorSummary : The provided role type was not the same as required role type., errorCauses:[]. ``` **Resolution** - Do not remove last app target or app instance target. Instead, directly remove the `APP_ADMIN` role or the `HELP_DESK_ADMIN` role from the user. ## Add Entitlement Failed is populated in the activity log while creating or updating APP Target, App Instance Target, or Group Target to User **Resolution** - Ensure the following: - While assigning APP target and App Instance Target to the user, APP\_ADMIN role is not in the request. - While assigning Group Target to the user, HELP\_DESK\_ADMIN role is not in the request. ## The Update Account attribute failed during the Enable operation The following error message is displayed while modifying the account attribute during the Enable operation: ```text Request execution failed. HTTP Error code : 409, Okta Error code : E0000112, errorSummary : Cannot update this user because they are still being activated. Please try again in a few minutes., errorCauses:[]. ``` **Resolution** - Add the following entry to the source XML using the REST APIs: ```text Patch https://{orgName}.api.identitynow.com/v2025/sources/{OktasourceID} ``` In the body of the Patch, use the form-data as follows: ```json { "op": "add", "path": "/connectorAttributes/connector_provisioningTimeout", "value": "20000" } ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## User status is not being updated after the Enable or Disable operation Due to slow Okta API response times, there may be a delay in receiving the correct user status after performing the Enable or Disable operation. **Resolution** - Add the following entry to the source XML using the REST APIs: ```text Patch https://{orgName}.api.identitynow.com/v2025/sources/{OktasourceID} ``` In the body of the Patch, use the form-data as follows: ```json { "op": "add", "path": "/connectorAttributes/connector_provisioningTimeout", "value": "20000" } ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Test connection failing with error message When performing a test connection, it fails and the following error displays: ```text Exception: sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Possible suggestions ] a) Make sure Okta instance is reachable. b) Make sure there is a smooth connectivity between Identity Server and Okta instance. [ Error details ] Failed to connect to the Okta instance. ``` If there is a firewall between SailPoint and the Okta tenant, it is likely causing the blocking the connection. **Resolution** - Verify if there are any firewall rules present in your environment that are blocking the Okta URL, FQDN, or IP address. If the rules are blocking this communication, unblock them. ## Custom role data for users is not getting aggregated correctly The Okta source supports the aggregation of custom roles that are assigned directly to the accounts only. **Resolution**: Before aggregation, ensure that custom roles for the users and groups are assigned directly. For example, let us assume that for the user John, John Test Role is a custom role. The John Test Role added for the user John is a direct assignment. But, if John Test Role is added to the Custom\_Group, and Custom\_Group is then assigned to the user John. Then, the John Test Role will not be a direct assignment for the user John.