Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

The create account operation fails even though the recommended attribute mappings are used in the Account Policy.

Resolution - Ensure that the managed system is enabled to set the account attributes used by the Account Policy, then try the Create account operation again.

Attribute values in Compliant Settings are not populated after aggregation and/or provisioning processes

You try to add a new attribute to Compliant Settings from the SCIM server endpoint schema to the account schema, but aggregation processes don't fetch the attribute value, and/or provisioning processes don't send the attribute to the managed system.

Resolution - Perform a Discover Source operation, and then run an unoptimized account aggregation.

Extended schema attributes for Group objects are not aggregated

Additional attributes added for Group objects are not included in entitlement aggregation.

Resolution:

  • Compliant - Add the required attributes to the group object schema and run an entitlement aggregation process.
  • Non-Compliant - Add the required attributes to the group object schema, and also properly map their respective JSON paths in the source, then run an entitlement aggregation process.

Endpoint is required for Non-Compliant

Resolution: If the Non-Compliant checkbox is enabled the connector will reach the following endpoints only from the SCIM server:

/Users - For Test Connection, Preview, Aggregation, and Provisioning.
/Groups - For Aggregation and Provisioning.

The following endpoints are not required if Non-Compliant is enabled:

/Schemas
/ResourceTypes
/ServiceProviderConfigs

The schema that gets discovered when enabling the Non-Compliant setting is the default schema the connector provides Out-Of-the-Box (OOB).

If any new attribute needs to be added, you must add it in the schema along with its valid JSON path in the JSON path attribute Mapping.

ResourceObject error message displays during aggregation

During aggregation the following error message displays:

ResourceObject is returned with null identity error

Resolution: Verify if the identity attribute is in the schema attribute else add the appropriate schema attribute name as identity attribute.

Aggregation fails with SSL peer shut down errors

Messages:

org.json.JSONException: SSL peer shut down incorrectly
Remote host terminated the handshake

Resolution: Configure the following in the application via the REST API:

  1. Set the SSL_PROTOCOL_VERSION to TLSv1.2 or TLSv1.3 to reflect your SSL version.
  2. Set the trustAllCert attribute to true.
  3. Set the allowAllHosts attribute to true.

Groups (entitlements) aren't aggregated due to non-compliance

Resolution: If the entitlement aggregation process doesn't aggregate groups then verify the following:

  • Check if the SCIM server has the {host} /Group endpoint available with the group's data.

  • If the group endpoint is not available, then groups can be aggregated using the /User endpoint. However, the group data should be in the /User endpoint's response.

    The following RFC shows the Representation of Users with group information. This has to be implemented in the SCIM server.

    RFC 7643: System for Cross-domain Identity Management: Core Schema - Refer to the Full User Representation section.

Incorrect JSON formed during Create/Modify account using multi-valued schema attributes

Resolution: Ensure to enable the provisionMultivaluedRFCCompatible parameter to support the correct JSON for provisioning multivalued schema attributes. Add the following attribute using the REST API for updating the source in SailPoint and then, try modifying the system to date of a user:

key=provisionMultivaluedRFCCompatible

value=true

Note

provisionMultivaluedRFCCompatible is a boolean attribute.

The manager attribute isn't included in provisioning

The connector doesn't provision the manager attribute from SCIM-compliant sources.

Resolution:

  1. Add the splitManager attribute to the source.xml and set it to true using the REST API.
  2. Remove <entry key="schemaPropertyMappings"> from the source.
  3. Run a Discover Schema process.

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Account aggregation fails with ConnectorException: Resource doesn't exist

Account aggregation fails with the following error:

ConnectorException: Resource doesn't exist

The SCIM 2.0 connector identifies payloads from meta.resourceType. If list-level meta exists without resourceType on /ResourceTypes or /Users, aggregation fails with Resource doesn't exist.

Example:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "meta": { "location": "https://example.com/Users" },
  "Resources": [{ "id": "123", "userName": "jdoe" }]
}

Resolution: Review the /ResourceTypes and /Users responses and verify that meta.resourceType is present. Contact the SCIM server team to add meta.resourceType to the response as described in RFC 7643: System for Cross-domain Identity Management: Core Schema.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.