Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

• SailPoint Identity Services Documentation
• SailPoint Support Knowledge Base
• SailPoint Developer Community

Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.

Provisioning of account fails with subsidiary not found exception error.

Exception occurred in setEmployee USER_ERROR: Please enter value(s) for: Subsidiary was not found.

Resolution: Ensure the subsidiary is active and the service user has all the required permissions.

Test connection fails with an error message

Test connection fails with the following error message:

java.net.UnknownHostException: webservices.netsuite.com

This issue may occur if there is no Internet connection.

Resolution: Ensure that there is Internet connection.

Provisioning fails with a message

The following message is displayed when no role is assigned to an employee:

The account dont have access permissions to netsuite server, so roles can not be added

Resolution: Perform the following:

1. Log in to Oracle NetSuite account.
2. Assign at least one role to Employee.
3. Run Account and Group aggregation.

Account/ Group Aggregation fails with an error message

Account/Group aggregation fails with the following error message:

The server encountered an unexpected error while contacting target system. Please check the logs.ExceededRequestLimitFault

Resolution: Perform either of the following:

• Use Token Based Authentication to achieve concurrent execution.
• Obtain the SuiteCloud plus license.

Test connection fails with Two-Factor Authentication Roles

Test Connection fails with the following error message when Two-Factor Authentication Roles is enabled (2FA authentication required) on the Managed System:

Enter valid Application ID, Email, Password, Role ID or verify user has valid permissions. [Error details] Error occurred before establishing the connection with NetSuite Server.InvalidCredentialsFault

Resolution: Use Token Based Authentication or disable the Two-Factor Authentication Roles (2FA) flag by setting it to not required on the Managed System (Oracle NetSuite).

Group aggregation fails due to timeout issue

When token-based authentication is used, group aggregation fails after 60 minutes due to timeout issue.

The Oracle NetSuite connector can be configured to use REST Web Services with SuiteQL in order to prevent group aggregation timeout.

Resolution: Perform the following:

1. Log in to your Oracle NetSuite account.

2. Enable Rest Web Service on the Oracle NetSuite tenant.

   1. Go to Setup > Company > Enable features.
   2. Select the SuiteCloud sub-tab.
   3. Check the REST WEB SERVICES in the SuiteTalk (Web Services) section.

3. Add the following additional permission to the role associated with the service account credentials:

   Permissions	Level	Sub-section of Permission Tab
   SuiteAnalytics Workbook	Edit	Report
   Bulk Manage Roles	Full	Setup
   REST Web Services	Full	Setup

4. Add following entry key to source XML file.

   Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial).

   <entry key="isSuiteQLEnable" value="true"/>
   

5. Perform entitlement aggregation.

Entitlement Aggregation is running slower than expected

Resolution: Perform the following:

1. Log in to your Oracle NetSuite account.

2. Enable Rest Web Service on the Oracle NetSuite tenant.

   1. Go to Setup > Company > Enable features.
   2. Select the SuiteCloud sub-tab.
   3. Check the REST WEB SERVICES in the SuiteTalk (Web Services) section.

3. Add the following additional permission to the role associated with the service account credentials:

   Permissions	Level	Sub-section of Permission Tab
   SuiteAnalytics Workbook	Edit	Report
   Bulk Manage Roles	Full	Setup
   REST Web Services	Full	Setup

4. Add following entry key to source XML file.

   Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial).

   <entry key="isSuiteQLEnable" value="true"/>
   

5. Perform entitlement aggregation.

Create account fails for child subsidiaries (Subsidiary Not Found)

Create account provisioning fails for users whose Subsidiary is a child subsidiary (for example, Box Poland Spzoo or KK Box Japan). The connector logs show:

"Box Poland Spzoo" Subsidiary Not Found in NetSuite manage system. Please check Subsidiary "Box Poland Spzoo" is active

Create account may succeed when you use the root or parent subsidiary (for example, Box, Inc.). It fails for child subsidiaries specified as bare or short names.

A downstream error might also appear for an invalid department reference against a NULL subsidiary:

Exception occurred in setEmployee INVALID_KEY_OR_REF:Invalid department reference key 130 for subsidiary .

Cause: The Oracle NetSuite connector resolves the Subsidiary field by exact name match, including hierarchy. Child subsidiaries are not accepted as bare display names. They must use the full hierarchical colon-separated format that NetSuite aggregation returns. When the bare name does not match, the Subsidiary is not applied on create. Dependent field validations (such as Department) then fail against an empty or incorrect subsidiary. The root subsidiary (for example, Box, Inc.) works as a plain name because it has no parent in the hierarchy.

Resolution: Use the full hierarchical Subsidiary path in your create and update account provisioning policies and transforms. The hierarchical format uses colon-separated names that match account aggregation.

Example - correct format:

Box, Inc. : Box International Holdings Ltd. : Box International Technology Ltd. : Box Poland Spzoo
Box, Inc. : KK Box Japan

Incorrect (bare name):

Box Poland Spzoo
KK Box Japan

Update your create and update provisioning policies and any transforms to send the full hierarchical Subsidiary name rather than the short display name alone.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.