# Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Retry Failures Encountered During Aggregation The SailPoint Identity Governance connector for ServiceNow attempts to retry aggregation failures (for various reasons, such as token expiration). **Resolution**: On the **Advanced Settings** page on the UI, add entries to the **Retry Error List** and enter the maximum number of times you want to retry the aggregation. The default number of retries is 1. ## If you Configure the Application to use OAuth 2.0 Authentication with the Refresh Token Grant Type and the Refresh Token is Expired or Invalidated on the ServiceNow Instance and Error is Displayed The ServiceNow source does not automatically regenerate the Refresh Token if it expires. The default Refresh Token lifespan is 8,640,000 seconds in ServiceNow. The following error is displayed when you have an expired token: ```text [ InvalidConfigurationException ] [ Possible suggestions ] a) Make sure the configuration details are correct. b) Make sure the user is active on the ServiceNow instance. [ Error details ] Authentication failed. Status: 401 , Output: access_denied, Detail: server_error ``` **Resolution**: Regenerate a new Refresh Token manually and go to **Connection Settings** and enter the new token in the **Refresh Token** field. ## A Record is Not Created or Updated If a record is not created or updated on ServiceNow and there are no errors displayed. **Resolution**: Verify the record in the relevant import set table is listed in the following: - SailPointSysUserGrmember - SailPointSysUsers - SailPointSysUserGroup ## Create Account Failed with an Error Message Create account failed with the following error message: ```text HTTP/1.0 302 Found ``` This error code indicates that the requested resource has been temporarily moved to the URL given by the location header. This error is displayed when `http` is used in the ServiceNow URL. **Resolution**: Use `https` in the ServiceNow URL. ## Unable to Provision Space " " to Custom Attribute for Choice Type List **Resolution**: Include an `onComplete` event script (which will run after all rows are already mapped from the staging table to the target table) on the respective ServiceNow instance. Then perform the following: - Mention the custom choice field type attributes that must be cleared. - Explicitly set the custom field type attribute string to `NULL` when the connector provisions a `--NONE--` string. Complete the following to reset the custom choice field type to `--NONE--`: 1. On the ServiceNow instance, configure custom attributes with Choice List and Select Type as string and Choice as `--NONE--` in the Choice List specification section of the `SailPointSysUser` table. 2. Go to **SailPoint Identity Governance Connector \> Transform Maps \> SailPointSysUser**. 3. Go to the **Transform Scripts** column section and select **New**. Then select the `onComplete` script in the **When** field section and add the script to reset Choice field attributes to `--NONE--` in the Script section. For example, for the following custom attributes with the Choice field type, set the attributes to `NULL` whenever the user sends the string `NONE` in SailPoint provisioning for the Choice field type. For a normal text field, a single space (`" "`) is enough to clear the target field. - `u_team` - `u_fruit` This can be defined in the `onComplete` event script as follows: ```javascript (function runTransformScript(source, map, log, target /*undefined onStart*/ ) { //Put here all the custom created choice fields as below if(source.u_team=="NONE") target.setValue('u_team',"NULL"); if(source.u_fruit=="NONE") target.setValue('u_fruit',"NULL"); //target should be updated only once target.update(); })(source, map, log, target); ``` > **Note** > > Similarly add the required respective choice field attributes in the above script whenever applicable. ## User Status Is Not Set Correctly During Account Aggregation When the language on the ServiceNow managed system is set to a language other than English, the user status is set incorrectly during account aggregation. **Resolution** - Set `sysparm_display_value` to `all` for the non-English ServiceNow platform using the **Advanced Settings \> Request Parameter Map** field. Refer to [Request Parameter Map]() for more information. ## User Group Warning Message The SailPoint Identity Governance Connector for ServiceNow logs a warning message when the connections of 'user to group' are not found. ## Company Attribute is not Aggregated in ServiceNow Error For the SailPoint Identity Governance connector for ServiceNow if there is error in the aggregation of the company attribute. **Resolution**: On your ServiceNow instance, create a read ACL on the `core_company` table and add the `x_sapo_iiq_connect.admin` role to it. ## Account Aggregation Error The following error is displayed: ```text Unable to fetch next block of account. Exception occurred during account aggregation. Transaction canceled: maximum execution time exceeded. ``` ServiceNow prevents inbound REST requests that are running for longer than 60 seconds. **Resolution**: Increase the transaction quota for REST request timeout using the following steps: 1. Go to **System Definition \> Transaction Quota Rule**. 2. Enter a higher value in **Maximum Duration** (seconds) for REST API request timeout. For more details on configuring Quota Rules, see the [ServiceNow Configure a transaction quota rule]() topic. ## Create / Provisioning Option Fails with an Error Message Create/ Provisioning operation fails with the following error message: ```text openconnector.InvalidRequestException: Native identifier cannot be empty, ERROR","message":"Failed to read the account 'null'. ``` ServiceNow fails to return success response back to SailPoint when required provisioning is successful at the ServiceNow side. **Resolution**: The service account must have the `import_admin` role for the provisioning operation to complete successfully. ## Unable to Assign the admin/security\_admin Role with Minimum Permissions The following error message appears when a user with minimum permissions assigns the `admin/security_admin` role: ```text sailpoint.connector.ConnectorException: [ConnectorException] [Error details] Request execution failed for the sys_id 'null'. Error occured during row insert; Target record not found ``` **Resolution**: Starting with the ServiceNow London release, ServiceNow does not allow a user with minimum permissions to assign the `admin/security_admin` role. ## Groups Are Not Being Pulled in Correctly During Account Aggregation When running account aggregation, groups are not being aggregated when using the `accountFilterAttribute` with multiple and/or conditions, and no errors are being displayed. **Resolution**: When adding the `accountFilterAttribute` to the account xml, instead of adding the filter condition as `source=piyush^ORsource=Pankaj`, set the filter condition using `sourceINPiyush,Pankaj` ## The Attribute is Not Synchronized This error occurs when the ServiceNow account attribute is not defined in the [Use Sys ID Reference]() and [Request Parameter Map]() fields. **Resolution**: Add the required attribute in the [Use Sys ID Reference]() field. Also, in the [Request Parameter Map]() field, set the value for `sysparm_display_value` equals to `all`. Refer to [Advanced Settings]() for more information. ## Only sys\_id is Getting Aggregated During Entitlement Aggregation During entitlement aggregation, the sys\_id value is getting aggregated instead of the Role Name/Display Value. **Resolution**: Ensure that the proper ServiceNow Admin permissions are provided on your ServiceNow instance. For more information, refer to the [Prerequisites]() section for the necessary Admin permissions. ## Delta Account Aggregation Takes a Long Time to Complete The entitlement attributes like groups and roles are present in the account schema and when the updated membership for users count is less, the delta account aggregation takes longer than expected. **Resolution**: Add the `maxDeltaAccountsCountToSkipCache` attribute in the Source XML with the value as per your requirement. The default value of this attribute is 0. For example, ```text key = "maxDeltaAccountsCountToSkipCache" value = "10" ``` This value must be optimal and should be decided on the basis of your environment and day-to-day delta account changes. > [!NOTE] > > The `maxDeltaAccountsCountToSkipCache` attribute is not valid/used during full aggregation. ## If you configure the application to use OAuth 2.0 authentication with the client credentials Grant Type and `invalid_scope` error is displayed while getting access token The following error message appears when getting an access token from the Okta Authorization server: ```text The authorization server resource does not have any configured default scopes, 'scope' must be provided. ``` **Resolution**: Add the scope attribute in the source XML with the value as per your requirement. The scope parameter is an optional parameter that does not contain a default value. For example, ```text key = "scope" value = "someScope" ``` ## ServiceNow attribute sync truncates Business Title to 60 characters **Resolution**: The staging table `x_sapo_iiq_connect_sysuser` and the `sys_user` table both limit the length of the `title` column length to 60. Update the max length in both tables accordingly. ## Authentication Fails with Status 401 The `create_ticket` operation fails with the following error: ```text Authentication failed. Status: 401 - User is not authenticated / Required to provide Auth information ``` This error indicates that ServiceNow rejected the integration credentials. The issue is related to the source configuration rather than a provisioning defect. **Resolution** - Verify the following: - The ServiceNow integration user is active. - For the password grant, the token URL is `https://.service-now.com/oauth_token.do`. - The username, password, client ID, and client secret are configured correctly. - For the refresh token grant, regenerate the refresh token and save the updated token in the source configuration. - The `oauth_token.do` endpoint returns HTTP 200 before you retry `create_ticket`.