Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

Aggregation fails with one of the following exception errors:

  • org.apache.http.NoHttpResponseException: failed to respond

  • connector.sdk.webservices.exception.WebServicesSdkException: java.net.SocketException: Socket closed

Resolution: Add the following attribute using the Rest API for updating a source, and then run aggregation.

Key= conSnowflakeApiRetrySleepTimeSeconds Value= 60000 in ms, default: 30000 ms

Key=conSnowflakeApiRetryMaxAttempts Value=3, default: 3

Key=retryableErrors Value=[error messages]

Resolution: Go to the Aggregation Settings page and increase the value in the Aggregation Timeout field. The default value is 180 seconds.

If you configured the connector to include some databases and exclude others, account aggregations processes are likely to fail. The connector can either include some databases or exclude databases.

Resolution: Configure the scope of the databases that the connector aggregates using either the Include Databases field or the Exclude Databases field, but not both.

When you try to configure the DEFAULT_SECONDARY_ROLES attribute, you get the following error:

SQL compilation error: invalid value [[()]] for parameter 'DEFAULT_SECONDARY_ROLES'

Resolution: Snowflake changed the default behavior of the DEFAULT_SECONDARY_ROLES attribute. Following this update, a user's DEFAULT_SECONDARY_ROLES attribute is set to ALL by default. For more information refer to the Snowflake knowledge base.

Note
The linked document is not maintained by SailPoint and is subject to change without notice.

Based on your required configuration, configure one of the following:

  • To set the DEFAULT_SECONDARY_ROLES attribute to ('ALL'), pass the value as null, NULL, ('all'), or ('ALL').

    For example:

    Copy 
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = null;
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = NULL;
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ('all');
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ('ALL');

  • To set the DEFAULT_SECONDARY_ROLES to an empty value, pass the value as ().

    For example:

    Copy 
    ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ();

Entitlement Aggregation fails with an SQL Execution Cancelled message or it is taking too long to complete.

Resolution: If your aggregation requirements will allow for it, you can remove roles and privileges from the Role schema to skip the SHOW GRANTS TO ROLE query. This action can expedite the entitlement aggregation process and avoid a timeout error.

Important
Making this change includes roles fetched during entitlement aggregation but not the privileges assigned to them.

You can also review timeout options in Timeout Errors and Settings.

Issue: During Add or Remove entitlement processes, if a role is identified as PUBLIC, the connector throws an exception and marks the item as failed.

Resolution: No actions are necessary. Operations involving the PUBLIC role have no impact on the Snowflake-managed system. The PUBLIC role is a mandatory default role granted to all users and cannot be revoked.