Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Retry Failures Encountered During Aggregation

The SailPoint Identity Governance connector for ServiceNow attempts to retry aggregation failures (for various reasons, such as token expiration).

Resolution: On the Advanced Settings page on the UI, add entries to the Retry Error List and enter the maximum number of times you want to retry the aggregation. The default number of retries is 1.

If you Configure the Application to use OAuth 2.0 Authentication with the Refresh Token Grant Type and the Refresh Token is Expired or Invalidated on the ServiceNow Instance and Error is Displayed

The ServiceNow source does not automatically regenerate the Refresh Token if it expires. The default Refresh Token lifespan is 8,640,000 seconds in ServiceNow.

The following error is displayed when you have an expired token:

[ InvalidConfigurationException ] [ Possible suggestions ] a) Make sure the configuration details are correct. b) Make sure the user is active on the ServiceNow instance. [ Error details ] Authentication failed. Status: 401 , Output: access_denied, Detail: server_error

Resolution: Regenerate a new Refresh Token manually and go to Connection Settings and enter the new token in the Refresh Token field.

A Record is Not Created or Updated

If a record is not created or updated on ServiceNow and there are no errors displayed.

Resolution: Verify the record in the relevant import set table is listed in the following:

SailPointSysUserGrmember
SailPointSysUsers
SailPointSysUserGroup

Create Account Failed with an Error Message

Create account failed with the following error message:

HTTP/1.0 302 Found

This error code indicates that the requested resource has been temporarily moved to the URL given by the location header. This error is displayed when http is used in the ServiceNow URL.

Resolution: Use https in the ServiceNow URL.

Unable to Provision Space " " to Custom Attribute for Choice Type List

Resolution: Include an onComplete event script (which will run after all rows are already mapped from the staging table to the target table) on the respective ServiceNow instance. Then perform the following:

Mention the custom choice field type attributes that must be cleared.
Explicitly set the custom field type attribute string to NULL when the connector provisions a --NONE-- string.

Complete the following to reset the custom choice field type to --NONE--:

On the ServiceNow instance, configure custom attributes with Choice List and Select Type as string and Choice as --NONE-- in the Choice List specification section of the SailPointSysUser table.
Go to SailPoint Identity Governance Connector > Transform Maps > SailPointSysUser.
Go to the Transform Scripts column section and select New. Then select the onComplete script in the When field section and add the script to reset Choice field attributes to --NONE-- in the Script section.

For example, for the following custom attributes with the Choice field type, set the attributes to NULL whenever the user sends the string NONE in SailPoint provisioning for the Choice field type. For a normal text field, a single space (" ") is enough to clear the target field.
- u_team
- u_fruit
This can be defined in the onComplete event script as follows:
```
(function runTransformScript(source, map, log, target /*undefined onStart*/ ) { //Put here all the custom created choice fields as below
if(source.u_team=="NONE")
target.setValue('u_team',"NULL");
if(source.u_fruit=="NONE")
target.setValue('u_fruit',"NULL");
//target should be updated only once
target.update();
})(source, map, log, target);
```
Note

Similarly add the required respective choice field attributes in the above script whenever applicable.

User Status Is Not Set Correctly During Account Aggregation

When the language on the ServiceNow managed system is set to a language other than English, the user status is set incorrectly during account aggregation.

Resolution - Set sysparm_display_value to all for the non-English ServiceNow platform using the Advanced Settings > Request Parameter Map field. Refer to Request Parameter Map for more information.

User Group Warning Message

The SailPoint Identity Governance Connector for ServiceNow logs a warning message when the connections of 'user to group' are not found.

Company Attribute is not Aggregated in ServiceNow Error

For the SailPoint Identity Governance connector for ServiceNow if there is error in the aggregation of the company attribute.

Resolution: On your ServiceNow instance, create a read ACL on the core_company table and add the x_sapo_iiq_connect.admin role to it.

Account Aggregation Error

The following error is displayed:

Unable to fetch next block of account. Exception occurred during account aggregation. Transaction canceled: maximum execution time exceeded.

ServiceNow prevents inbound REST requests that are running for longer than 60 seconds.

Resolution: Increase the transaction quota for REST request timeout using the following steps:

Go to System Definition > Transaction Quota Rule.
Enter a higher value in Maximum Duration (seconds) for REST API request timeout.

For more details on configuring Quota Rules, see the ServiceNow Configure a transaction quota rule topic.

Create / Provisioning Option Fails with an Error Message

Create/ Provisioning operation fails with the following error message:

openconnector.InvalidRequestException: Native identifier cannot be empty, ERROR","message":"Failed to read the account 'null'.

ServiceNow fails to return success response back to SailPoint when required provisioning is successful at the ServiceNow side.

Resolution: The service account must have the import_admin role for the provisioning operation to complete successfully.

Unable to Assign the admin/security_admin Role with Minimum Permissions

The following error message appears when a user with minimum permissions assigns the admin/security_admin role:

sailpoint.connector.ConnectorException: [ConnectorException] [Error details] Request execution failed for the sys_id 'null'. Error occured during row insert; Target record not found

Resolution: Starting with the ServiceNow London release, ServiceNow does not allow a user with minimum permissions to assign the admin/security_admin role.

Groups Are Not Being Pulled in Correctly During Account Aggregation

When running account aggregation, groups are not being aggregated when using the accountFilterAttribute with multiple and/or conditions, and no errors are being displayed.

Resolution: When adding the accountFilterAttribute to the account xml, instead of adding the filter condition as source=piyush^ORsource=Pankaj, set the filter condition using sourceINPiyush,Pankaj

The Attribute is Not Synchronized

This error occurs when the ServiceNow account attribute is not defined in the Use Sys ID Reference and Request Parameter Map fields.

Resolution: Add the required attribute in the Use Sys ID Reference field. Also, in the Request Parameter Map field, set the value for sysparm_display_value equals to all. Refer to Advanced Settings for more information.

Only sys_id is Getting Aggregated During Entitlement Aggregation

During entitlement aggregation, the sys_id value is getting aggregated instead of the Role Name/Display Value.

Resolution: Ensure that the proper ServiceNow Admin permissions are provided on your ServiceNow instance. For more information, refer to the Prerequisites section for the necessary Admin permissions.

Delta Account Aggregation Takes a Long Time to Complete

The entitlement attributes like groups and roles are present in the account schema and when the updated membership for users count is less, the delta account aggregation takes longer than expected.

Resolution: Add the maxDeltaAccountsCountToSkipCache attribute in the Source XML with the value as per your requirement. The default value of this attribute is 0. For example,

key   = "maxDeltaAccountsCountToSkipCache"
value = "10"

This value must be optimal and should be decided on the basis of your environment and day-to-day delta account changes.

Note

The maxDeltaAccountsCountToSkipCache attribute is not valid/used during full aggregation.

If you configure the application to use OAuth 2.0 authentication with the client credentials Grant Type and `invalid_scope` error is displayed while getting access token

The following error message appears when getting an access token from the Okta Authorization server:

The authorization server resource does not have any configured default scopes, 'scope' must be provided.

Resolution: Add the scope attribute in the source XML with the value as per your requirement. The scope parameter is an optional parameter that does not contain a default value. For example,

key = "scope"
value = "someScope"

ServiceNow attribute sync truncates Business Title to 60 characters

Resolution: The staging table x_sapo_iiq_connect_sysuser and the sys_user table both limit the length of the title column length to 60. Update the max length in both tables accordingly.

Authentication Fails with Status 401

The create_ticket operation fails with the following error:

Authentication failed. Status: 401 - User is not authenticated / Required to provide Auth information

This error indicates that ServiceNow rejected the integration credentials. The issue is related to the source configuration rather than a provisioning defect.

Resolution - Verify the following:

The ServiceNow integration user is active.
For the password grant, the token URL is https://<instance>.service-now.com/oauth_token.do.
The username, password, client ID, and client secret are configured correctly.
For the refresh token grant, regenerate the refresh token and save the updated token in the source configuration.
The oauth_token.do endpoint returns HTTP 200 before you retry create_ticket.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.