# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Provisioning of account fails with subsidiary not found exception error.

```text
Exception occurred in setEmployee USER_ERROR: Please enter value(s) for: Subsidiary was not found.
```

**Resolution**: Ensure the subsidiary is active and the service user has all the required permissions.

## Test connection fails with an error message

Test connection fails with the following error message:

```text
java.net.UnknownHostException: webservices.netsuite.com
```

This issue may occur if there is no Internet connection.

**Resolution**: Ensure that there is Internet connection.

## Provisioning fails with a message

The following message is displayed when no role is assigned to an employee:

```text
The account dont have access permissions to netsuite server, so roles can not be added
```

**Resolution**: Perform the following:

1. Log in to Oracle NetSuite account.
2. Assign at least one role to Employee.
3. Run Account and Group aggregation.

## Account/ Group Aggregation fails with an error message

Account/Group aggregation fails with the following error message:

```text
The server encountered an unexpected error while contacting target system. Please check the logs.ExceededRequestLimitFault
```

**Resolution**: Perform either of the following:

- Use **Token Based Authentication** to achieve concurrent execution.
- Obtain the SuiteCloud plus license.

## Test connection fails with Two-Factor Authentication Roles

Test Connection fails with the following error message when Two-Factor Authentication Roles is enabled (2FA authentication required) on the Managed System:

```text
Enter valid Application ID, Email, Password, Role ID or verify user has valid permissions. [Error details] Error occurred before establishing the connection with NetSuite Server.InvalidCredentialsFault
```

**Resolution**: Use **Token Based Authentication** or disable the Two-Factor Authentication Roles (2FA) flag by setting it to **not required** on the Managed System (Oracle NetSuite).

## Group aggregation fails due to timeout issue

When token-based authentication is used, group aggregation fails after 60 minutes due to timeout issue.

The Oracle NetSuite connector can be configured to use REST Web Services with SuiteQL in order to prevent group aggregation timeout.

**Resolution**: Perform the following:

1. Log in to your Oracle NetSuite account.
2. Enable Rest Web Service on the Oracle NetSuite tenant.

   1. Go to **Setup \> Company \> Enable features**.
   2. Select the **SuiteCloud** sub-tab.
   3. Check the **REST WEB SERVICES** in the SuiteTalk (Web Services) section.
3. Add the following additional permission to the role associated with the service account credentials:

   | Permissions | Level | Sub-section of Permission Tab |
   | --- | --- | --- |
   | SuiteAnalytics Workbook | Edit | Report |
   | Bulk Manage Roles | Full | Setup |
   | REST Web Services | Full | Setup |
4. Add following entry key to source XML file.

   Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>).

   ```text
   <entry key="isSuiteQLEnable" value="true"/>
   ```
5. Perform entitlement aggregation.

## Entitlement Aggregation is running slower than expected

**Resolution**: Perform the following:

1. Log in to your Oracle NetSuite account.
2. Enable Rest Web Service on the Oracle NetSuite tenant.

   1. Go to **Setup \> Company \> Enable features**.
   2. Select the **SuiteCloud** sub-tab.
   3. Check the **REST WEB SERVICES** in the SuiteTalk (Web Services) section.
3. Add the following additional permission to the role associated with the service account credentials:

   | Permissions | Level | Sub-section of Permission Tab |
   | --- | --- | --- |
   | SuiteAnalytics Workbook | Edit | Report |
   | Bulk Manage Roles | Full | Setup |
   | REST Web Services | Full | Setup |
4. Add following entry key to source XML file.

   Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>).

   ```text
   <entry key="isSuiteQLEnable" value="true"/>
   ```
5. Perform entitlement aggregation.

## Create account fails for child subsidiaries (Subsidiary Not Found)

Create account provisioning fails for users whose Subsidiary is a child subsidiary (for example, `Box Poland Spzoo or KK Box Japan`). The connector logs show:

```text
"Box Poland Spzoo" Subsidiary Not Found in NetSuite manage system. Please check Subsidiary "Box Poland Spzoo" is active
```

Create account may succeed when you use the root or parent subsidiary (for example, Box, Inc.). It fails for child subsidiaries specified as bare or short names.

A downstream error might also appear for an invalid department reference against a NULL subsidiary:

```text
Exception occurred in setEmployee INVALID_KEY_OR_REF:Invalid department reference key 130 for subsidiary .
```

**Cause:** The Oracle NetSuite connector resolves the Subsidiary field by exact name match, including hierarchy. Child subsidiaries are not accepted as bare display names. They must use the full hierarchical colon-separated format that NetSuite aggregation returns. When the bare name does not match, the Subsidiary is not applied on create. Dependent field validations (such as Department) then fail against an empty or incorrect subsidiary. The root subsidiary (for example, `Box, Inc.`) works as a plain name because it has no parent in the hierarchy.

**Resolution:** Use the full hierarchical Subsidiary path in your create and update account provisioning policies and transforms. The hierarchical format uses colon-separated names that match account aggregation.

Example - correct format:

```text
Box, Inc. : Box International Holdings Ltd. : Box International Technology Ltd. : Box Poland Spzoo
Box, Inc. : KK Box Japan
```

Incorrect (bare name):

```text
Box Poland Spzoo
KK Box Japan
```

Update your create and update provisioning policies and any transforms to send the full hierarchical Subsidiary name rather than the short display name alone.