# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Transport Error 401 Error

```text
org.apache.axis2.AxisFault: Transport error: 401 Error: HTTP/1.1 401 Unauthorized
```

This error can happen when the incorrect ClientID is entered in the source configuration.

**Resolution** - Correct the configuration details to resolve the issue.

## Unable to verify SAML assertion signature

```text
Unable to verify the signature of the SAML assertion
```

**Resolution** - The Client ID and Private key values should be correctly provided. These values must be a part of the same OAuth2 Client Applications.

## Unable to authenticate client - Invalid user

```text
Unable to authenticate the client (Login failed - Invalid user)
```

**Resolution** - Ensure that the User ID value is correct.

## Unable to authenticate client - Login failed - IP address is prohibited

A test connection fails with the following message:

```text
Unable to authenticate the client (Login failed - login from IP address <ip_address> is prohibited. You can set an API login exception to allow login from this IP address)
```

The SuccessFactors source may have restrictions to the IP addresses used to access the APIs required to support connector functions. They may also be blocking the Virtual Appliance's IP address (external IP address).

**Resolution** - Allow the necessary IP addresses per the following SAP knowledge base articles:

- [2161058 - Error in SuccessFactors API: "Attempted login from unauthorized ip"](<https://userapps.support.sap.com/sap/support/knowledge/en/2161058>)
- [Restricting API Access by IP Addresses or IP Address Ranges](<https://help.sap.com/docs/SAP_SUCCESSFACTORS_PLATFORM/d599f15995d348a1b45ba5603e2aba9b/265b5fa29d0a426d943cba2ae57e079b.html>)

> [!NOTE]
>
> The linked documents are not maintained by SailPoint and are subject to change without notice.

## Server is down or connection parameters are incorrect

Test Connection fails with the following error message:

```text
"[ ConnectorException ] [ Error details ] Exception occurred while iterate operation, refer logs for more details. Server is DOWN or Connection parameters are incorrect."
```

**Resolution** - Verify the connection parameters and check with your network team for the firewall restrictions.

## Authorization failed for REST: Status code=404

A test connection fails with the following error message:

```text
[ InvalidConfigurationException ] [ Possible suggestions ] Provide correct version of URL. [ Error details ] Authorization failed for REST: status code=404 Version of rest URL is not correct
```

**Resolution** - To support the assignment of a primary role to the service account, set **Target Population User Type** to **Employee** in the SuccessFactors managed system.

If you need to aggregate external users, set **Target Population User Type** to **External Onboarding User** in the SuccessFactors managed system.

## Timeout issue

```text
java.lang.RuntimeException: java.lang.InterruptedException: Timeout
```

**Resolution** - Use the REST API to add the `aggregateTimeout` attribute.

```text
POST <url>/api/source/update/<sourceID>
```

- `<url>` - The URL for the customer's SailPoint tenant
- `<sourceID>` - The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

- **Key** - `connector_aggregateTimeout`
- **Value** - Add as time in milliseconds

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Waiting for response from client

```text
java.lang.RuntimeException - java.lang.RuntimeException: java.lang.InterruptedException: Timeout waiting for response to message 3 from client 84a5de19-2861-4ca5-a8a1-ed4481e43e60 after 180 seconds
```

**Resolution** - Increase the timeout value using the REST API:

```text
POST <url>/api/source/update/<sourceID>
```

- `<url>` - The URL for the customer's SailPoint tenant
- `<sourceID>` - The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

- **Key** - `connector_aggregateTimeout`
- **Value** - Add as time in milliseconds, for example you can use 1000.

## Read timed out and entity value missing or no associated data found

The SuccessFactors connector displays the following error:

```text
"sailpoint.connector.ConnectorException: java.net.SocketTimeoutException: Read timed out" and "Possible suggestions : \n additional entity value is missing or \n No associated Data Found"
```

**Resolution** - Correct the XPaths for additional attributes added in the connector configuration. The semantics or syntax may be incorrect. For more information, refer to [Aggregating Additional Schema Attributes Using SFAPI](<https://documentation.sailpoint.com/connectors/successfactors/va/help/additional_attribute_aggregation.html#aggregating-additional-schema-attributes-using-sfapi>).

## Inconsistent data (null and incorrect values for default attributes) being aggregated from end system at different hours

This error occurs due to the tenant's preferred timezone in SailPoint not aligning with SuccessFactors portal tenant timezone.

**Resolution** - Ensure the timezone is correct. If not, update the timezone accordingly and re-run the aggregation. For more information, refer to [Tenant timezone on SF portal](<https://help.sap.com/docs/successfactors-platform/using-admin-center/tenant-preferred-time-zone>).

## Inconsistent data aggregation or null values for default attributes on the start date or end date of an employee

**Resolution** - Follow the below steps:

1. Check whether the filter criteria in the **Aggregation Settings** on the source configuration is set to either "Employees" or "Users".

   When it is set to Users, records with statuses `active_external_suite ('e')` or `inactive_external_suite('d')` or those from Onboarding Module 2.0 whose hiring is completed on the target system are included in aggregation. When it is set to Employees, these records are ignored.
2. To manually exclude these records with statuses from aggregation, add the following entry to the source XML using REST API's:

   ```xml
   <entry key="excludePendingHires">
   <value>
   <Boolean></Boolean>
   </value>
   </entry>
   ```
3. Save the changes and rerun aggregation.

## Zero accounts are returned even after successful account aggregation

**Resolution** - Your source permissions and additional picklist values are not completely aligned with recommended practices:

- Ensure that the service account has all the Required Permissions.
- The Picklist ID value is different than the default values used. To change this value, refer to [Exporting and Verifying the Picklist Values](<https://documentation.sailpoint.com/connectors/successfactors/va/help/picklist_configuration.html#exporting-and-verifying-the-picklist-values>).
- Ensure the picklist values are correct or configured as described in [Configuring Picklists](<https://documentation.sailpoint.com/connectors/successfactors/va/help/picklist_configuration.html>).

## Picklist values are not aligned with recommended practices

Zero accounts are returned with this message:

```text
Your permissions and additional picklist values are not completely aligned with recommended practices. Refer connector guidelines to set expected values.
```

**Resolution** - Ensure that:

- The required permissions mentioned in Required Permissions are added and perform the aggregation again.
- The Picklist values are correct or configured as described in [Configuring Picklists](<https://documentation.sailpoint.com/connectors/successfactors/va/help/picklist_configuration.html>).

## Fewer accounts than expected are returned even after successful account aggregation

The picklist values may differ from the default values in the connector.

**Resolution** - Ensure that the picklist values are correct or configured as described in [Configuring Picklists](<https://documentation.sailpoint.com/connectors/successfactors/va/help/picklist_configuration.html>).

## Aggregation fails with message about user unable to manage roles

```text
User '[<userId>]' does not have permission to manage roles.
```

**Resolution** - Ensure that the **Manage Role-Based Permission Access** permission is assigned to the user. For more information, refer to Required Permissions.

## Exception during aggregation of Object Type account on Application SF

```text
Unable to create iterator sailpoint.connector.InsufficientPermissionException:
[ InsufficientPermissionException ] [ Possible suggestions ] Provide the required permissions for the user. [ Error details ] "error" : { "code" : "COE_GENERAL_FORBIDDEN", "message" :{ "lang" : "en-US", "value" : "[COE0020]User [UserId] attempted to access dynamic group module [permission] without proper access privilege." }
```

**Resolution** - Ensure that the **Manage Role-Based Permission Access** permission is assigned to the service account user when the Roles and Groups attributes are added to the account schema object. For more information, refer to Required Permissions.

## Aggregation fails even though required permissions are set

```text
Entity FOLocation is not found. Please check the entity in Admin Center > OData API Data Dictionary or contact your system administrator
```

**Resolution** - Perform the following:

1. In SuccessFactors, go to **Admin Center** and search for **OData API Metadata Refresh And Export**.
2. Select **Refresh**.
3. Wait for the task to be completed.

## Error messages for user accessing dynamic group module and lacking permissions

```text
User [userId] attempted to access dynamic group module [permission] without proper access privilege.
```

and

```text
User "[userId]" does not have permission to manage roles
```

**Resolution** - Ensure the **Manage Role-Based Permission Access** permission is correctly assigned.

## Additional Entity Value is Missing or No associated Data Found

If the entities are not defined in the SuccessFactors managed system, then this error message displays:

```text
Additional Entity Value is Missing or No associated Data Found

"Got exception while parsing the active list
sailpoint.connector.ConnectorException: SFWebServiceFaultException
Exception during aggregation. Reason: java.lang.RuntimeException: sailpoint.connector.ConnectorException: SFWebServiceFaultException
java.lang.RuntimeException: sailpoint.connector.ConnectorException: SFWebServiceFaultException
```

**Resolution** - Ensure that defined and validated attributes are added to **Include Compound Employee API Entities** on the managed system. For more information, refer to [Including Compound Employee API Entities](<https://documentation.sailpoint.com/connectors/successfactors/va/help/advanced_settings.html#include-compound-employee-api-entities>).

> [!NOTE]
>
> After the update, make sure to remove these values from the **Include Compound Employee API Entities** field as this field should contain only the nodes defined on the managed system.

## Aggregation fails with REST status code 404

```text
Authorization failed for REST: status code=404 Version of rest URL
```

**Resolution** - When specifying the target population to whom granted users have permission to access, exclude granted users from having the permission access to themselves. To do this, deselect the **Exclude granted users from having the permission access to themselves** checkbox.

## Delta aggregation is not working and the aggregation flow always runs a full aggregation

**Resolution** - Update the `supportsDeltaAgg` entry in the source using the REST API:

```text
POST <url>/api/source/update/<sourceID>
```

- `<url>` - The URL for the customer's SailPoint tenant
- `<sourceID>` - The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

- **Key** - `supportsDeltaAggt`
- **Value** - `["true"]`

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Identity information is missing following delta aggregation

Following a delta aggregation process, identity information such as `username` is missing.

**Cause** - The Compound API's standard query mode supports the Identity Information segment, but the delta mode does not. In delta mode, the system aggregates only the information included in `querymode=delta` for Compound Employee as part of delta aggregation processes.

**Resolution** - As a workaround, update `PerPerson` (biographical information) in parallel with an employee's Identity Information.

## Unknown format conversion exception

During aggregation the connector displays the following error:

```text
Caused by: java.util.UnknownFormatConversionException: Conversion = '1" during aggregation.
```

This issue occurs due to a picklist migration issue where two picklists with the same ID exists on both the MDF and Legacy sides (prior to the migration), but do not match. The migration keeps them separate and appends a suffix to their IDs.

**Resolution** - Complete the following:

- Refer to the [SAP documentation](<https://userapps.support.sap.com/sap/support/knowledge/E/2909791>) for more information on the causes of the error and the steps to resolve the issue.
- Update the `picklistConfigMap` entry in the source XML using the REST APIs.

  > **Note**
  >
  > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Entitlement aggregation fails with connector process failure

```text
[ConnectorError] error receiving response from connector: stream client connection is broken (connector process may have crashed):
```

**Resolution**: Reduce the value of the `connector_batchSizeUserGroup` and `connector_batchSizeUserRole` attributes using the SailPoint REST API. These attributes determines the number of roles/groups being fetched at a time. The default value for each attribute is `100`, and you can enter from `1` to `100`.

```json
[
    {
        "op": "add",
        "path": "/connectorAttributes/connector_batchSizeUserGroup",
        "value": "<value>"
    }
]

[
    {
        "op": "add",
        "path": "/connectorAttributes/connector_batchSizeUserRole",
        "value": "<value>"
    }
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Aggregation fails on an authoritative source

Aggregation fails on an authoritative source with the following error message:

```text
sailpoint.connector.ConnectorException: class java.util.ArrayList cannot be cast to class java.lang.String (java.util.ArrayList and java.lang.String are in module java.base of loader 'bootstrap'
```

**Resolution** - Verify that any of the schema attributes included in the aggregation are properly set to multi-valued or single-valued on the end system. If any are incorrectly set, correct them before performing the aggregation process.

## External Users with "e" or "d" statuses are included in aggregation when they shouldn't be

**Resolution** - Follow the steps below to exclude External Users with an `e` or `d` status from aggregation:

> [!NOTE]
>
> External Users can be accounts from the Onboarding Module with a status of `e` or `d`.

1. Add the following to the source XML via REST API:

   ```xml
   <entry key="excludePendingHires">
     <value>
        <Boolean>false</Boolean>
     </value>
   </entry>
   ```

   > **Note**
   >
   > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.
2. Restart the virtual appliance.
3. Run an aggregation to check if external users are properly excluded from aggregation.

## Fewer accounts than expected are returned even after successful account aggregation (VA cluster requirements)

**Resolution** - Confirm that the VA cluster meets all basic [system and network requirements](<https://documentation.sailpoint.com/saas/help/va/requirements_va.html>) as documented.

## Delta aggregation fails with the error

Delta aggregation fails with the following error when the number of changed users exceeds the OData API's maximum request line size (8,192 characters):

```text
sailpoint.connector.ConnectorException: {"fault":{"faultstring":"request line size exceeding 8,192","detail":{"errorcode":"protocol.http.TooBigLine"}}}
```

**Resolution:** The connector now supports chunked execution for delta account aggregation. To enable this, add the following key to the application XML:

```text
<entry key="chunkDeltaUserOdataRequests" value="true">
```

The default chunk size is 100. If you need to change the chunk size, configure the following key:

```text
<entry key="odataInClauseSize" value="<pageSize>">
```

> [!IMPORTANT]
>
> SailPoint does not recommend provisioning attributes that are excluded from aggregation using the entity filters.

## Picklist Mapping is required field and cannot be blank

```text
connector.InvalidConfigurationException: PickList Mapping is required field and cannot be blank.
```

**Resolution** - Ensure that the picklist is configured with the correct values.

## No application attributes are configured for attribute synchronization

```text
IllegalStateException: No application attributes are configured for attribute synchronization
```

**Resolution** - Ensure that the identity attributes are synchronized with account attributes correctly.

## No data exists for the provided user

The following error message displays during provisioning and GET operations:

```text
sailpoint.connector.InvalidRequestException: No data exists for the provided user, please check nativeIdentity identityName(for e.g TestUser1)
```

**Resolution** - Perform the following:

1. Check the target population in the group that is assigned to the service account role.
2. Ensure that the **Manage Role-Based Permission Access** permission is assigned to service account user when the Roles and Groups attributes are added to the account schema object.

## Older employment information data is displayed for an account after Provisioning

**Resolution** - Check if the permissions have been properly set for the service account. Remove any extra permissions that are not mentioned in Required Permissions.

## Duplicate username HTTP 500 error

SuccessFactors `Username` provisioning fails with the following error message:

```text
Error in provisioning the httpcode: 500 error messsage: DUPLICATE_USERNAME : Failed to add/update user
```

**Resolution** - SuccessFactors allows you to update the `Username` attribute to a new and unique value, but not to a value that was previously assigned to it. For more information, refer to [SAP Notes](<https://me.sap.com/notes/0002217113>).

## The connector doesn't provision the BusinessEmail attribute

The SuccessFactors connector does not allow provisioning for the `BusinessEmail` attribute if it is a part of additional attribute mapping in the source. The error message returned is as follows:

```text
Provisioning operation failed for BusinessEmail.Ensure the attribute BusinessEmail is valid and added in account schema.
```

**Resolution** - Add the entry for picklist mapping in the source as follows:

```text
PrimaryEmailAddress=<Associated Picklist optionID>
```

> [!NOTE]
>
> The value for `PrimaryEmailAddress` can be the user's business email address or personal email address.

Alternatively, you can configure the `BusinessEmail` attribute directly as follows:

```text
BusinessEmail=<Associated Picklist optionID>
```

> [!CAUTION]
>
> Do not add `BusinessEmail` as an attribute in the additional attribute mapping section as the connector does not support additional attributes provisioning.

## Provisioning error message: "Ensure configuration parameters are with valid format": cannot be cast to class java.lang.string

Provisioning processes fail, and the connector returns the following error message:

```text
"Ensure configuration parameters are with valid format" :cannot be cast to class java.lang.string
```

**Resolution** - Ensure the source configuration parameters are correct and also in the right format syntactically. This can be confirmed by comparing the source config with a brand new default source.

## Invalid Session Error

```text
[ ConnectorException ] [ Possible suggestions ] Ensure configuration parameters are correct with a valid format, Ensure active network connectivity between Source and Target system. [ Error details ] java.lang.RuntimeException: Authorization failed for SOAP INVALID_SESSION error message- Invalid SFAPI session!
```

This error occurs when there is an issue with the SuccessFactors managed target system.

**Resolution** - One of the resolutions is to ensure that the Base Company URL is the API URL for the SuccessFactors managed target system, and not the WEB URL. For example:

- Web URL - `https://salesdemo4.successfactors.com`
- API URL - `https://apisalesdemo4.successfactors.com`

## Inconsistent or abnormal connector behavior for a particular duration

For example, receiving incorrect account statuses, not aggregating any accounts, or connection failures.

**Resolution** - Verify that there were no abnormalities, connection issues, or updates on the target system during the duration that you are seeing the inconsistent or abnormal behavior by checking with the SuccessFactors administrator and network team.

## Attribute value is not aggregated correctly when the picklist value is provided in a language other than US English

**Resolution** - Ensure that the picklist value is maintained in US English within the translation settings of the picklist configuration.

## FutureActions attribute incomplete: same-day job changes are missing

The `FutureActions` account schema attribute does not include all future job events occurring on the same day. This leads to incomplete account data in SailPoint for users with same-day future-dated job changes.

**Resolution** - To ensure all future events are included in the `FutureActions` attribute, add the following attribute using Rest API for updating a source in SailPoint and then run the account aggregation.

Key= allJobChangesPerDay Value= "true"

> [!NOTE]
>
> - The default value for `allJobChangesPerDay` is false.
> - This setting ensures that all job changes occurring on the same day are included in the `FutureActions` attribute.

## SuccessFactors Picklist labels are missing after aggregation

During account aggregation, the SuccessFactors connector does not populate attribute labels if the target SuccessFactors system is configured to use a picklist language other than the default US English (en\_US).

**Resolution:** Add the below key in the application configuration with SuccessFactors picklist locale/language.

```text
<entry key="picklistLocale" value="th_TH"/>
```