# Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## SAP connector using the /SAILPOINT/SAIL\_READ\_TABLE function module fails with an error caused by class during aggregation. Error message: ```text com.sap.conn.jco.JCoException: (104). Data is lost while copying a value. Message 341 of class 00 type X: SAPSQL_DATA_LOSS. SAP_QUERY_TABLE_NAME:TUTYP” ``` **Resolution:** Update the client language in the source XML from `` to `` value and retry aggregation. ## Adding a new role overwrites the existing list of role assignments This is the BAPI behavior when the **Role Details** attribute is missing from account schema. **Resolution**: Add the **Role Details** attribute in account schema to resolve the issue. ```xml Role Details of the User ``` ## The connector does not fetch the User Group account attribute information during aggregation **Resolution**: Go into the groups tab of the account and ensure that the User Group has been assigned. ## The password is not deactivated during account creation When creating a new account, the password is not deactivated even when the correct parameters are passed. **Resolution**: Add CODVN in the create account provisioning form. If you need the password to be deactivated, then the password should not be sent from the plan. When the provisioning form is displayed, clear out the password field. The password deactivated field should be set as X/true. ## Account aggregation logs a WARN-level error ```text Exception while getting system info from CVERS and PRDVERS tables sailpoint.connector.ConnectorException: Caused by class com.sap.conn.jco.AbapException: (126) TABLE_ACCESS_NOT_ALLOWED: Message 000 of class null type : . SAP_QUERY_TABLE_NAME:CVERS ``` **Resolution**: Provide the correct permissions to the service account user on the CVERS and PRDVERS tables. Additionally, ensure both of the following additions have been made: 1. CVERS/PRDVERS is added in S\_TABU\_NAME authorization object. 2. CVERS/PRDVERS is added in SAILPOIN/CONF table. ## ASSIGN\_TYPE\_CONFLICT exception occurs in UI during connector operations An Error message is displayed when using Function Module /SAILPOIN/SAIL\_READ\_TABLE and /SAILPOIN /SAIL\_READ\_TABLE\_LEG ```text Exception during aggregation. Reason: java.lang.RuntimeException: ASSIGN_TYPE_CONFLICT while querying table *Table_Name*. One of the fields queried (field1,field2,field3… ) may have incorrect COLUMN_LENGTH set in /SAILPOIN/CONF table. Please refer ASSIGN_TYPE_CONFLICT in troubleshooting section of documentation for more details. ``` **Resolution:** Ensure COLUMN\_LENGTH is correctly configured for the fields of *Table\_Name* in /SAILPOIN/CONF table . This can be validated through the t-code "SE11" while viewing the table details under the **Fields** tab. ## Data was lost while copying a value error and aggregation fails ```text Data was lost while copying a valuePOST ``` **Resolution**: If SAP has been patched to SP 17 or later, change the client language to a single character. For example, if the client language is `EN`, change it to `E`. For more information on the One Character Code for Language, refer to the [SAP KB article](). ## Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory error on test connection and aggregations in SailPoint ```text Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory ``` **Resolution**: The host value must be updated on VA with the FQDN of the SAP server. Re-upload the `sapjco` and `libsapjco` JARs on the UI. > [!NOTE] > > Ensure that all SAP sources pointing to the same VA cluster have the latest and identical versions of SAP JARs uploaded. ## Initialization of repository destination SAP - PMP failed error on test connection ```text [ ConnectorException ] [ Error details ] Exception occurred while test configuration operation, refer logs for more details. Initialization of repository destination SAP - PMP failed: Logon data incomplete. ``` **Resolution**: Ensure the Flag for "Entry for RFC activated " is unchecked and not selected in SAP server. ## Distribution of a user to SAP CUA Subsystem In a SAP CUA landscape, a SAP role or profile requires a SUBSYSTEM to distribute the user to. The facility to select or specify the same, while requesting an entitlement for an account, is absent. **Resolution**: The subsystem name is prepended to the Account-Group while aggregating account-groups from a SAP CUA system. As a result, only a limited subset of subsystem and account-group combinations are available while requesting entitlements, and thus distributing users, in a SAP CUA landscape. ## Entitlement description isn't populated correctly. Entitlements aren't added to access profile ```text Invalid Entitlement. managedAttribute is missing. ``` **Resolution**: In Account Schema, update the schemaObjectType value of the Roles and Child Roles attributes to Group. ## Removed Entitlements are present in Current access page Even after the execution of **Refresh Entitlement Correlation** the entitlements are not getting deleted from the current access page. **Resolution**: Execute the **Perform Identity Request Maintenance** task to remove those entitlements. Ensure that the **Verify provisioning for requests** option is selected for this task. ## Change password is not working with SNC when PRODUCTIVE\_PWD attribute is X The change password feature is not working with SNC, when PRODUCTIVE\_PWD attribute is X. **Resolution**: ```text POST ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. Where: - `` is the URL for the customer's SailPoint tenant. - `` is the Source ID (number) obtained through the UI. In the body of the POST, set form-data values as follows: - **Key**: `connector_productivePasswordValue` - **Value**: Value for example, 1. By default the value is X. **Resolution 2**: Check the following jco parameters and add them in the source xml as per your environment requirements: ```xml true ``` ```xml ``` The possible values of X are: - 1: Authentication only - 2: Integrity protection - 3: Privacy protection - 8: Use the value from `snc/data_protection/use` on the SAP Application Server. ```xml ``` The possible values of X are: - 0: Single Sign-On protocol disabled - 1: Single Sign-On protocol enabled Set the value to 0 as of JCo 3.0.9 **Resolution 3**: Ensure the SNC name in table SNCSYSACL (transaction SNC0), is not maintained. If it is present, remove the entry from the table. ## Aggregation fails with error 'NOT AUTHORIZATION' Aggregation fails with the following error due to not having proper authorization of authorization object 'S\_TABU\_DIS (Activities: All Activities)'. **Resolution**: Provide the authorization of authorization object **S\_TABU\_DIS (Activities: All Activities)** ```text Activities-All Table Authorization Group-* (means all) ``` Or skip aggregation of license data of the user by adding the following entry key using the REST API as follows: ```text POST /api/source/update/ ``` Where: - `` is the URL for the customer's SailPoint tenant - `` is the Source ID (number) obtained through the UI In the body of the POST, set form-data values as follows: - **Key**: `connector_skipLicenseData` - **Value**: `true` ## com.sap.conn.rfc.driver.CpicDirver error on test connection Test connection fails with the following error message: ```text com.sap.conn.rfc.driver.CpicDirver ``` **Resolution**: Download the latest `SAPJCO.jar` and `SAPJCO.dll` files from SAP Marketplace and then use that SAPJCO Jar file with the latest downloaded SAPJCO dll file. ## Role and Profile description in a language other than English **Resolution**: In Account-Group Aggregation, if the Role and Profile Description is required in a language other than English, add the `descriptionLanguage` parameter with the correct value. ```text POST /api/source/update/ ``` Where: - `` is the URL for the customer's SailPoint tenant - `` is the Source ID (number) obtained through the UI In the body of the POST, set form-data values as follows: - **Key**: descriptionLanguage - **Value**: The language code. For example, D. - **Key**: `descriptionAttribute` - **Value**: `Description` In the above example, the value `D` is the language code for Dutch language supported by SAP. If the `descriptionLanguage` parameter is not provided, the descriptions displayed are in English language. ## Bad username or password. com.sap.conn.jco.JCoException on test connection Test connection /aggregation fails with the following error message: ```text Bad username or password. com.sap.conn.jco.JCoException: (109) RFC_ERROR_CANCELLED: Handle close pending ``` **Resolution**: Ensure that the administrator user specified in application has sufficient rights on the SAP systems as mentioned in the [Required Permissions]() section. ## Test connection or aggregation fails if user name or password contains a UTF-8 character **Resolution**: Use the REST API to add an entry for `jco.client.pcs` attribute ```text POST /api/source/update/ ``` Where: - `` is the URL for the customer's SailPoint tenant - `` is the Source ID (number) obtained through the UI In the body of the POST, set form-data values as follows: - **Key**: `connector_jco.client.pcs` - **Value**: 2 ## The SAP connector does not cause the following error after using the after-provisioning rule to assign an entitlement. ```text "RfcGetException: Name or password is incorrect (repeat logon)" ``` ## Entitlement aggregation fails with OutOfMemory error ```text Exception: java.lang.OutOfMemoryError: Java heap space Exception during aggregation of Object Type group on Application ``` **Resolution**: One of the possible reasons for this failure is that a role contains a large number of Authorization Objects. To resolve this error, set the `splitAuthObjectValues` attribute using the REST API and use the body of : ```text [ { "op": "add", "path": "/connectorAttributes/splitAuthObjectValues", "value": true } ] ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Provisioning fails with an error message when trying to configure SNC using SAP JCO version 3.1 Provisioning fails with the following error message when trying to configure SNC using SAP JCO version 3.1 and when the `client.snc_sso` parameter is set to `0` in the application debug page: ```text "WARN: Warning from SAP while executing function [BAPI_USER_CHANGE]Password for user XXXX changed, but not set as productive" ``` **Resolution**: The value of `client.snc_sso` parameter must be set to 1 (that is, `client.snc_sso = 1`) or not defined (default is 1) in the SAP application. On the SAP managed system, JCO (SNC Name) value must not be specified in JCO ACL, that is JCO entry must be deleted from `SNC0` tcode (table `SNCSYSACL`). Refer to SAP Note \# 3016480 as recommended by SAP and only specific to SAP JCO 3.1.x. ## SAP source config test connection fails when the VA is configured with secure tunnel, or when the VA and manage system are on a different network ```text "sailpoint.connector.ConnectionFailedException: Server is DOWN or Connection parameters are incorrect. ``` OR ```text ERROR hostname 'sailpoint-va' unknown\nTIME ``` OR ```text JCO_ERROR_COMMUNICATION: Connect to SAP gateway failed ``` **Resolution**: There are three possible options to solve this error. **Option 1**: One of the reasons for the issue to occur is the IP address of the VA is not recognized by the connector. To resolve this, you must make an entry in hosts.yaml with the IP address of the VA as well as the managed source (SAP server). > [!NOTE] > > For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](). For example: ```text hosts: 10.200.80.60: -SAPSER4 10.22.131.14: -sailpoint-va ``` Where `10.200.80.60` is the IP and `SAPSER4` is the hostname of the SAP server, and `10.22.131.14` is the IP of the VA and `sailpoint-va` is the default name of the VA. Ensure that SAP is installed with JCO enabled. Similarly, add the IP and hostname of the VA being used in the file. Restart CCG/ Reboot VA after the update. **Option 2**: Add Route entry in static.network file to persist routing table entry of the VA hostname. To do so, perform the following steps: 1. In your VA, go to ../etc/systemd/network/static.network 2. Add the following entry: ```text [Route] Gateway=<10.0.0.1> Destination=/ ``` 3. Run `sudo systemctl restart systemd-networkd` to apply the configuration. 4. Run `route -n` to show routes. 5. Restart CCG/ Reboot VA and check if the entry still persisted. **Option 3**: Update DNS entries for VAs on your network so that FQDN resolves for each VA. To do so, perform the following steps: 1. Run `sudo hostnamectl set-hostname ` to set the VA hostname. 2. Run the `hostname` command to validate. 3. Run `sudo reboot` to reboot the VA. The VA should reflect the new hostname. ## SAP connector throws "Unencrypted communication is rejected by this system" error when snc/only\_encrypted\_rfc is set to 1 on SAP server ```text [ ConnectorException ] [ Error details ] Exception occurred while test configuration operation, refer logs for more details. Initialization of repository destination SAP FS failed: Unencrypted communication is rejected by this system. ``` **Resolution:** Please check the 'snc/only\_encrypted\_rfc' parameter on SAP server, if set to 1, SAP server expects encrypted connections to it. We need to either set the value for this parameter to 0 or setup SNC connection both on SailPoint UI and SAP server to communicate. ## Provisioning operation is failing due to a "Locked by user" error When parallel requests are sent from the SailPoint platform to SAP for provisioning entitlements or attributes associated with the same identity, the provisioning request may fail with a following error- ```text "Locked by user " ``` **Resolution:** The restriction to not update any user with multiple consecutive requests has been implemented by SAP. This is a common practice built with most of the ERP systems to avoid conflicting changes to be made to any record. If the user id is already being edited by any request, the system stops the other requests to perform further updates on it until the previous request is complete. The workaround to resolve this situation could be to implement re-tries and introduce delay conditions between consecutive requests or when this specific error is observed. ## The retry mechanism fails to provision Provisioning fails with either a `Locked by user` error or a `connection reset` error. **Resolution**: To configure retry mechanism in the SAP Direct connector, ensure to add the following entry key using the REST API: In the body of the POST, set form-data values as follows: ```text Key:retryWaitTime Value:30 Key:maxRetryCount Value:3 Key:retryableErrors Value:[error messages] ``` where, `retryWaitTime` is in seconds. The default value of `retryWaitTime` is 5 sec. The default value of `maxRetryCount` is 3. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Account aggregation is not returning any records **Resolution**: Change the language on the managed system to a single letter (that is, from EN to E) and then, run aggregation. ## Provisioning Fails Due to Missing RFC Authorization for SYSTEM\_RESET\_RFC\_SERVER Function Module **Issue**: A runtime error occurs in the SAP system during provisioning activities. ```text The user "**" in client "*" attempted to execute the function module SYSTEM_RESET_RFC_SERVER from function group "**", but does not have the required RFC authorization. ``` **Resolution**: Ensure that the service account used by the connector is granted all required authorizations as specified in the Connector Guide under the [Required Permissions]() section. Once the correct authorizations are in place, the connector will be able to execute SYSTEM\_RESET\_RFC\_SERVER and recover from RFC communication issues as expected. ## Group aggregation fails during execution. **Resolution**: Add the aggregateTimeout key to the app.xml file as shown below: ```text ``` > [!NOTE] > > The value for aggregateTimeout (configured in seconds) can be adjusted based on the volume of entitlements configured on your managed system. ## Aggregation or test connection fails with InsufficientPermissionException Aggregation or test connection fails with an error similar to the following: ```text [ InsufficientPermissionException ] [ Possible suggestions ] Required permission of table "TUTYPA" is missing, ensure adding recommended permissions. [ Error details ] Caused by class com.sap.conn.jco.AbapException: (126) TABLE_ACCESS_NOT_ALLOWED: Message 010 of class /SAILPOIN/CL_ER_MSG type E: TUTYPA SAP_QUERY_TABLE_NAME:TUTYPA LIST_QUERY: ?? EQ && ``` The table name in the error might differ. For example, the error might list `USR02`, `TUTYP`, or `AGR_1251`. Use the table name after `SAP_QUERY_TABLE_NAME:` or in the connector suggestion message. The SailPoint service account cannot read the SAP table named in the error. When you use the SailPoint ABAP Add-on function module (`/SAILPOIN/SAIL_READ_TABLE`), configure table access in both of the following places: 1. SAP authorization - the service account role must include table display permissions. 2. `/SAILPOIN/CONF` configuration - the table and its allowed columns must be registered for your service account. Complete both configurations. Completing only one still produces this error. **Resolution**: Complete both of the following checks: 1. Verify SAP authorization. Compare the table against [Required Permissions]() and add the missing table to the service account role. 2. Verify the `/SAILPOIN/CONF` table configuration. Compare the same table in [Configuration Table for SAP Direct]() and confirm that entries exist for your service account.