Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Unable to find valid certification path to requested target

The following error message appears when multiple versions of Java are installed on the same computer, and the valid certification path is not found to the requested target.

Error - main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Resolution - Ensure correct OnGuard certificates are added at /home/sailpoint/certificates or Ensure correct and valid OnGuard certificates are present on VA required to connect the OnGuard Server.

javax.net.ssl.SSLPeerUnverifiedException: Hostname <hostname> Not Verified

Resolution - Make sure the Fully Qualified Domain Name (FQDN) of the machine on which the OnGuard Solution is installed is defined.

Fatal Errors from OnGuard Requiring Human Intervention

If the OnGuard connector encounters any of the following fatal errors, manual investigation and corrective action may be needed:

"The username/password combination you have entered is incorrect";
"The OpenAccess license has expired";
"The license for this application is currently unavailable";
"The event subscription does not exist";

Resolution - Review the error details and take the necessary manual steps to correct the configuration, license status, or system setup.

Incorrect Data in Badge and Access Level Attributes

Inaccurate data displayed in the following attributes:

Active Badges
Inactive Badges
Active Access Levels
Inactive Access Levels

Resolution - This issue caused by incorrect timezone settings.

Ensure the same and correct timezone is selected in all of the following:

  • Connector Configuration
  • OnGuard Server
  • System where the OnGuard Event Subscriber Service is running

Certificate Path Building Failed Error

The following error is displayed:

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Resolution - This error indicates that the OnGuard root certificate is either missing or not correctly imported into the Java cacerts truststore. Re-import the root certificate and verify the installation. Also, ensure that you import the certificate into the same Java environment (cacerts) that is being used to run IdentityIQ.

  • To import on Windows:

    keytool -importcert ^
 -alias onguard ^
 -file "C:\Users\user\Documents\OnGuard\ls_server_cert.pem" ^
 -keystore "C:\Program Files\Java\jdk-17\lib\security\cacerts" ^
 -storepass changeit

    Verify installation:

    keytool -list ^
 -keystore "C:\Program Files\Java\jdk-17\lib\security\cacerts" ^
 -storepass changeit | findstr onguard

    If successful, you will see the alias onguard listed.

  • To import on macOS / Linux (RHEL)

    sudo keytool -importcert \
 -alias onguard \
 -file <path-to-cert-file> \
 -keystore <path-to-java-home>/lib/security/cacerts \
 -storepass changeit

    Verify installation:

    keytool -list \
 -keystore <path-to-java-home>/lib/security/cacerts \
 -storepass changeit | grep onguard

    If successful, you will see the alias onguard listed.

java.net.UnknownHostException:<hostname>: Name or service not known

Resolution - The hostname is not properly mapped or is missing in the VA configuration.

  1. Verify that the hostname is correctly mapped on the VA (Virtual Appliance).
  2. If the issue persists, perform the following steps:

Custom attribute is missing or shows an unexpected value

Resolution - Set the schema attribute name to the OnGuard internal field name, for example, CUSTOM_ATTR, and not the label shown on the OnGuard form.

If a custom attribute shows an unexpected value, confirm that the account schema attribute uses the exact OnGuard internal field name and the correct type: int or long for whole numbers, and string for text, dates, and decimals. A date custom attribute must be string. After aggregation, a date appears in ISO-8601 format in the connector time zone, for example, 1989-01-01T05:30:00+05:30, and not as the date-only value shown in OnGuard.

Updating a custom attribute fails with system.invalid_field

Resolution - Verify the format of the field. If it is a date field, check the format OnGuard expects and provide the value in that format only, often yyyy-MM-dd, for example, 2008-08-09. Do not send the aggregated ISO-8601 value unless OnGuard expects that format.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.