Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

Aggregation fails with one of the following exception errors:

  • org.apache.http.NoHttpResponseException: failed to respond

  • connector.sdk.webservices.exception.WebServicesSdkException: java.net.SocketException: Socket closed

Resolution: Add the following attribute using the Rest API for updating a source, and then run aggregation.

Key= conSnowflakeApiRetrySleepTimeSeconds Value= 60000 in ms, default: 30000 ms

Key=conSnowflakeApiRetryMaxAttempts Value=3, default: 3

Key=retryableErrors Value=[error messages]

Resolution: Go to the Aggregation Settings page and increase the value in the Aggregation Timeout field. The default value is 180 seconds.

When you try to configure the DEFAULT_SECONDARY_ROLES attribute, you get the following error:

SQL compilation error: invalid value [[()]] for parameter 'DEFAULT_SECONDARY_ROLES'

Resolution: Snowflake changed the default behavior of the DEFAULT_SECONDARY_ROLES attribute. Following this update, a user's DEFAULT_SECONDARY_ROLES attribute is set to ALL by default. For more information refer to the Snowflake knowledge base.

Note
The linked document is not maintained by SailPoint and is subject to change without notice.

Based on your required configuration, configure one of the following:

  • To set the DEFAULT_SECONDARY_ROLES attribute to ('ALL'), pass the value as null, NULL, ('all'), or ('ALL').

    For example:

    Copy 
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = null;
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = NULL;
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ('all');
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ('ALL');

  • To set the DEFAULT_SECONDARY_ROLES to an empty value, pass the value as ().

    For example:

    Copy 
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ();

Entitlement Aggregation fails with an SQL Execution Cancelled message or it is taking too long to complete.

Resolution: If your aggregation requirements will allow for it, you can remove roles and privileges from the Role schema to skip the SHOW GRANTS TO ROLE query. This action can expedite the entitlement aggregation process and avoid a timeout error.

Important
Making this change includes roles fetched during entitlement aggregation but not the privileges assigned to them.

You can also review timeout options in Timeout Errors and Settings.