# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Unable to find valid certification path to requested target

The following error message appears when multiple versions of Java are installed on the same computer, and the valid certification path is not found to the requested target.

```text
Error - main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```

**Resolution** - Ensure correct OnGuard certificates are added at /home/sailpoint/certificates or Ensure correct and valid OnGuard certificates are present on VA required to connect the OnGuard Server.

## javax.net.ssl.SSLPeerUnverifiedException: Hostname \<hostname\> Not Verified

**Resolution** - Make sure the Fully Qualified Domain Name (FQDN) of the machine on which the OnGuard Solution is installed is defined.

## Fatal Errors from OnGuard Requiring Human Intervention

If the OnGuard connector encounters any of the following fatal errors, manual investigation and corrective action may be needed:

```text
"The username/password combination you have entered is incorrect";
"The OpenAccess license has expired";
"The license for this application is currently unavailable";
"The event subscription does not exist";
```

**Resolution** - Review the error details and take the necessary manual steps to correct the configuration, license status, or system setup.

## Incorrect Data in Badge and Access Level Attributes

Inaccurate data displayed in the following attributes:

```text
Active Badges
Inactive Badges
Active Access Levels
Inactive Access Levels
```

**Resolution** - This issue caused by incorrect timezone settings.

Ensure the same and correct timezone is selected in all of the following:

- Connector Configuration
- OnGuard Server
- System where the OnGuard Event Subscriber Service is running

## Certificate Path Building Failed Error

The following error is displayed:

```text
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```

**Resolution** - This error indicates that the OnGuard root certificate is either missing or not correctly imported into the Java cacerts truststore. Re-import the root certificate and verify the installation. Also, ensure that you import the certificate into the same Java environment (cacerts) that is being used to run IdentityIQ.

- To import on Windows:

  ```shell
  keytool -importcert ^
   -alias onguard ^
   -file "C:\Users\user\Documents\OnGuard\ls_server_cert.pem" ^
   -keystore "C:\Program Files\Java\jdk-17\lib\security\cacerts" ^
   -storepass changeit
  ```

  Verify installation:

  ```shell
  keytool -list ^
   -keystore "C:\Program Files\Java\jdk-17\lib\security\cacerts" ^
   -storepass changeit | findstr onguard
  ```

  If successful, you will see the alias **onguard** listed.
- To import on macOS / Linux (RHEL)

  ```shell
  sudo keytool -importcert \
   -alias onguard \
   -file <path-to-cert-file> \
   -keystore <path-to-java-home>/lib/security/cacerts \
   -storepass changeit
  ```

  Verify installation:

  ```shell
  keytool -list \
   -keystore <path-to-java-home>/lib/security/cacerts \
   -storepass changeit | grep onguard
  ```

  If successful, you will see the alias **onguard** listed.

## java.net.UnknownHostException:\<hostname\>: Name or service not known

**Resolution** - The hostname is not properly mapped or is missing in the VA configuration.

1. Verify that the hostname is correctly mapped on the VA (Virtual Appliance).
2. If the issue persists, perform the following steps:

   - Add the host entry as described in the [Configuring a Hosts.yaml File](<https://documentation.sailpoint.com/saas/help/va/config_va.html#configuring-a-hostsyaml-file>) documentation.
   - Restart the CCG service.
   - Reboot the VA.

## Custom attribute is missing or shows an unexpected value

**Resolution** - Set the schema attribute name to the OnGuard internal field name, for example, `CUSTOM_ATTR`, and not the label shown on the OnGuard form.

If a custom attribute shows an unexpected value, confirm that the account schema attribute uses the exact OnGuard internal field name and the correct type: `int` or `long` for whole numbers, and `string` for text, dates, and decimals. A date custom attribute must be `string`. After aggregation, a date appears in ISO-8601 format in the connector time zone, for example, `1989-01-01T05:30:00+05:30`, and not as the date-only value shown in OnGuard.

## Updating a custom attribute fails with system.invalid\_field

**Resolution** - Verify the format of the field. If it is a date field, check the format OnGuard expects and provide the value in that format only, often `yyyy-MM-dd`, for example, `2008-08-09`. Do not send the aggregated ISO-8601 value unless OnGuard expects that format.