Troubleshooting
If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.
For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:
- SailPoint Identity Services Documentation
- SailPoint Support Knowledge Base
- SailPoint Developer Community
Debug Logs
For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.
Invalid Configuration Exception (OAuth Token Audience Issue)
Root cause: Oracle changed the secondary audience and scopes: REST API authentication with OAuth 2.
Resolution: Configure the EPM Cloud service tenant and integrated applications as described in Create IDCS Client Application.
Full Account Aggregation Isn't Aggregating All of the Users
Resolution: Use the HTTP PATCH method to enable the useApprolesExtension attribute in the source xml with the value = true. Retry account aggregation.
Inactive Users Are Not Aggregated with Full Account Aggregation.
Resolution: Oracle EPM cloud connector aggregates active users only because user can only be disabled from IDCS system. Once it is disabled, the link from EPM is disappeared.
JWT Token Error. Invalid User Assertion: Token Has Invalid Issue Time.
Exception in JWT token generation : {"error":"invalid_grant","error_description":"Invalid user assertion: Token has invalid issue time.","ecid":"Iq^nO1ten10000000"}
Resolution: The issue arises if the VAs in the cluster have different times, or if the timezone of Oracle differs from the VA. Check the time of each VA by using sudo timedatectl on the VA. If any VAs have different times, then your infrastructure team must fix the time on the machine. Additionally, ensure the VA timezone and Oracle timezone is the same.
Schemas 2.0 Error
{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error","urn:ietf:params:scim:api:oracle:idcs:extension:messages:Error"],"detail":"You are not allowed to perform any actions on this page.","status":"401","urn:ietf:params:scim:api:oracle:idcs:extension:messages:Error":{"messageId":"error.common.common.accessDenied"}}
Resolution: Ensure the service user created has logged in at least once to the target EPM Cloud Service before using it for SailPoint integration.
Illegal Base64 Error
Resolution: Ensure the certificate or private key entered is a single string without any new line characters.
JWT Token Unknown Host Error
Exception in JWT token generation : java.net.UnknownHostException: <service_url>: nodename nor servname provided, or not known
Resolution: Enter the valid IDCS/System URL to authenticate the required resources.
JWT Token Invalid Client Error
Exception in JWT token generation : {"error":"invalid_client","error_description":"Client authentication failed.","ecid":"L^PYG08YA20000000"}
Resolution: Ensure the entered Client ID and Client Secret are correct and refer to the correct client application that is created in IDCS for SailPoint integration.
JWT Assertion Creation Failed Could Not Parse Certificate Error
[ ConnectorException ] [ Error details ] JWT Assertion creation failed. Could not parse certificate: java.io.IOException: Empty input
Resolution: Ensure the entered certificate is correct or copied correctly before entering it into the field.
Not Enough Valid Bits Error
Resolution: Ensure the entered certificate is correct or copied correctly before entering it into the field.
Input Byte Array Error
Resolution: Ensure the entered private key is correct or copied correctly before entering it into the field.
JWT Assertion Creation Failed Java Security InvalidKey Error
[ ConnectorException ] [ Error details ] JWT Assertion creation failed. java.security.InvalidKeyException: IOException : DerInputStream.getLength(): lengthTag=55, too big.
Resolution: Ensure the entered private key is correct or copied correctly before entering it into the field.
Exception While Fetching Groups Error
Resolution: Ensure the entered EPM System URL is correct.
Error While Fetching User Error
Resolution: Ensure the user has a direct predefined role or at least one IDCS Group assigned to the user.
Exception During Entitlement Assignments
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Draft//EN"> <HTML> <HEAD> <TITLE>Error 404--Not Found</TITLE> </HEAD> <BODY bgcolor="white"> <FONT FACE=Helvetica><BR CLEAR=all> <TABLE border=0 cellspacing=5><TR><TD><BR CLEAR=all> <FONT FACE="Helvetica" COLOR="black" SIZE="3"><H2>Error 404--Not Found</H2> </FONT></TD></TR> </TABLE> <TABLE border=0 width=100% cellpadding=10><TR><TD VALIGN=top WIDTH=100% BGCOLOR=white><FONT FACE="Courier New"><FONT FACE="Helvetica" SIZE="3"><H3>From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:</H3> </FONT><FONT FACE="Helvetica" SIZE="3"><H4>10.4.5 404 Not Found</H4> </FONT><P><FONT FACE="Courier New">The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent.</p><p>If the server does not wish to make this information available to the client, the status code 403 (Forbidden) can be used instead. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address.</FONT></P> </FONT></TD></TR> </TABLE> </BODY> </HTML>
Resolution: Ensure there is not a forward slash '/' at the end of the base URL in the source configuration page.
Exception While Removing Entitlement for User
["Request to remove all assigned IDCS entitlements of the user was rejected","because this will result in deleting the user. 'Delete' the user to achieve the same behaviour."]
Resolution: Ensure there is at least one predefined role or IDCS group present when removing entitlements.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.