Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.

The create account operation fails even though the recommended attribute mappings are used in the Account Policy.

Resolution - Ensure that the managed system is enabled to set the account attributes used by the Account Policy, then try the Create account operation again.

Attribute values in Compliant Settings are not populated after aggregation and/or provisioning processes

You try to add a new attribute to Compliant Settings from the SCIM server endpoint schema to the account schema, but aggregation processes don't fetch the attribute value, and/or provisioning processes don't send the attribute to the managed system.

Resolution - Perform a Discover Source operation, and then run an unoptimized account aggregation.

Extended schema attributes for Group objects are not aggregated

Additional attributes added for Group objects are not included in entitlement aggregation.

Resolution:

  • Compliant - Add the required attributes to the group object schema and run an entitlement aggregation process.
  • Non-Compliant - Add the required attributes to the group object schema, and also properly map their respective JSON paths in the source, then run an entitlement aggregation process.

Test connections fail with 401 Unauthorized errors

Issue - Test connections fail with the following error:

401 Unauthorized using grant type as - Client Credentials

Cause - Some SCIM servers require additional Headers for token generation to support client credentials as a grant type.

Resolution - Add the following to the OAuth Headers configuration in the connector:

Key - Authorization

Value - Basic clientId:ClientSecret (base64 Encoded)

For more information, refer to Client Credentials.

Connector fails to accept 204 No Content for PATCH requests

Issue - The SCIM 2.0 SaaS connector does not accept a 204 No Content response for PATCH requests.

Resolution - Enable acceptEmptyResponseForPatchCall flag in application xml.

acceptEmptyResponseForPatchCall flag is used to handle SCIM targets that return empty response bodies such as a 204 No Content status code for PATCH requests.

PATCH operations for core attributes omit the path

Issue - The SCIM 2.0 SaaS connector sends PATCH requests for core attributes such as name.givenName and name.familyName using a value-based format without an explicit path.

Example payload:

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "replace",
            "value": {
                "name": {
                    "givenName": "KC"
                }
            }
        }
    ]
}

Resolution - Enable the includePathForCoreAttributes: true flag in the application XML using the REST API, then re-run the attribute sync operation. The connector then uses an explicit path format for PATCH operations on core attributes.

Example payload with the flag enabled:

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "replace",
            "path": "name.familyName",
            "value": "Nabel"
        }
    ]
}

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.