# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Test Connection Errors

**Error**: The following error displays when testing the connection:

```text
Test Connection failed: ; nested exception is: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```

**Resolution**: Ensure that a valid TLS certificate is present in the correct directory.

**Error**: The following error displays when the test connection fails:

```text
Test Connection failed: ; nested exception is: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```

**Resolution**: Ensure that a valid TLS certificate is present in the correct directory.

**Error**: The following error displays when the test connection fails:

```text
Test Connection failed: Could not access HTTP invoker remote service; nested exception is javax.net.ssl.SSLPeerUnverifiedException: Host name does not match the certificate subject provided by the peer
```

If the source is configured with IP, the `enableHostNameVerification` is enabled, and certificate subject has FQDN, then test connection fails with this error.

**Resolution**: If `enableHostNameVerification` is enabled, FQDN/IP that is configured in the source must be present in the Certificate subject name

**Error**: The following error displays when testing the connection fails:

```text
Test Connection failed: Could not found the realm
```

**Resolution**: Ensure that relevant permissions are assigned to the service account. Refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/rsa_authentication_manager/va/help/index.html#required-permissions>).

## Aggregation Errors

**Error**: Account aggregation does not retrieve all accounts from the configured Active Directory identity source.

**Resolution**: Verify if the load balancer is configured between RSA and Active Directory, if it is there, it must be removed.

**Error**: The following error displays during aggregation:

```text
Session not found exception
```

**Resolution**: Set the following values in RSA Authentication Manager:

- Time out idle sessions: 90min
- Limit session lifetime: 12hrs

## Provisioning Errors

**Error**: The following error displays during provisioning:

```text
Create user failed: Identity Source <Source Name>' is read-only. Failed to create account!
```

**Resolution**: You may be trying to provision to an external data source. The RSA source only supports provisioning to an internal source.