# Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Create account operation fails while using recommended mappings in the Account Policy The create account operation fails even though the recommended attribute mappings are used in the Account Policy. **Resolution** - Ensure that the managed system is enabled to set the account attributes used by the Account Policy, then try the Create account operation again. ## Attribute values in Compliant Settings are not populated after aggregation and/or provisioning processes You try to add a new attribute to Compliant Settings from the SCIM server endpoint schema to the account schema, but aggregation processes don't fetch the attribute value, and/or provisioning processes don't send the attribute to the managed system. **Resolution** - Perform a [Discover Source]() operation, and then run an unoptimized account aggregation. ## Extended schema attributes for Group objects are not aggregated Additional attributes added for Group objects are not included in entitlement aggregation. **Resolution**: - **Compliant** - Add the required attributes to the group object schema and run an entitlement aggregation process. - **Non-Compliant** - Add the required attributes to the group object schema, and also properly map their respective JSON paths in the source, then run an entitlement aggregation process. ## Endpoint is required for Non-Compliant **Resolution**: If the Non-Compliant checkbox is enabled the connector will reach the following endpoints only from the SCIM server: ```text /Users - For Test Connection, Preview, Aggregation, and Provisioning. /Groups - For Aggregation and Provisioning. ``` The following endpoints are not required if Non-Compliant is enabled: ```text /Schemas /ResourceTypes /ServiceProviderConfigs ``` The schema that gets discovered when enabling the Non-Compliant setting is the default schema the connector provides Out-Of-the-Box (OOB). If any new attribute needs to be added, you must add it in the schema along with its valid JSON path in the JSON path attribute Mapping. ## ResourceObject error message displays during aggregation During aggregation the following error message displays: ```text ResourceObject is returned with null identity error ``` **Resolution**: Verify if the identity attribute is in the schema attribute else add the appropriate schema attribute name as identity attribute. ## Aggregation fails with SSL peer shut down errors Messages: ```text org.json.JSONException: SSL peer shut down incorrectly Remote host terminated the handshake ``` **Resolution**: Configure the following in the application via the REST API: 1. Set the `SSL_PROTOCOL_VERSION` to **TLSv1.2** or **TLSv1.3** to reflect your SSL version. 2. Set the `trustAllCert` attribute to `true`. 3. Set the `allowAllHosts` attribute to `true`. ## Groups (entitlements) aren't aggregated due to non-compliance **Resolution**: If the entitlement aggregation process doesn't aggregate groups then verify the following: - Check if the SCIM server has the `{host} /Group` endpoint available with the group's data. - If the group endpoint is not available, then groups can be aggregated using the `/User` endpoint. However, the group data should be in the `/User` endpoint's response. The following RFC shows the Representation of Users with group information. This has to be implemented in the SCIM server. [RFC 7643: System for Cross-domain Identity Management: Core Schema]() - Refer to the *Full User Representation* section. ## Incorrect JSON formed during Create/Modify account using multi-valued schema attributes **Resolution**: Ensure to enable the `provisionMultivaluedRFCCompatible` parameter to support the correct JSON for provisioning multivalued schema attributes. Add the following attribute using the REST API for updating the source in SailPoint and then, try modifying the system to date of a user: `key=provisionMultivaluedRFCCompatible` `value=true` > [!NOTE] > > `provisionMultivaluedRFCCompatible` is a boolean attribute. ## The manager attribute isn't included in provisioning The connector doesn't provision the `manager` attribute from SCIM-compliant sources. **Resolution**: 1. Add the `splitManager` attribute to the source.xml and set it to `true` using the REST API. 2. Remove `` from the source. 3. Run a **Discover Schema** process. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Account aggregation fails with ConnectorException: Resource doesn't exist Account aggregation fails with the following error: ```text ConnectorException: Resource doesn't exist ``` The SCIM 2.0 connector identifies payloads from `meta.resourceType`. If list-level `meta` exists without `resourceType` on `/ResourceTypes` or `/Users`, aggregation fails with `Resource doesn't exist`. Example: ```json { "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"], "meta": { "location": "https://example.com/Users" }, "Resources": [{ "id": "123", "userName": "jdoe" }] } ``` **Resolution**: Review the `/ResourceTypes` and `/Users` responses and verify that `meta.resourceType` is present. Contact the SCIM server team to add `meta.resourceType` to the response as described in [RFC 7643: System for Cross-domain Identity Management: Core Schema]().