Skip to content

Active Directory Troubleshooting and Validation

Steps to validate a successful integration and troubleshoot common issues.

Validation Steps After Connection

  1. Verify integration in SailPoint Entro Console

    In SailPoint Entro Console go to Management → Accounts & Integrations → Active Directory.

  2. Confirm account status

    Verify account status shows Verified.

  3. Check findings and inventory

    Confirm findings appear in Findings and object inventory under Activity Logs.

  4. Check sync timestamp

    Check last sync timestamp on the integration card.

Data Visibility Checks

  • Confirm users and groups listed in SailPoint Entro match AD counts.

  • Search for a known user in SailPoint Entro inventory and verify attributes such as userPrincipalName and memberOf.

LDAP Bind Test (Run from Connector Host)

  • Test LDAP (unencrypted, if permitted):

    ldapsearch -x -H ldap://dc01.example.local -D "svc_entro@example.local" -w '<PASSWORD>' -b "DC=example,DC=local" "(objectClass=user)" -s sub cn

  • Test LDAPS:

    ldapsearch -x -H ldaps://dc01.example.local -D "svc_entro@example.local" -w '<PASSWORD>' -b "DC=example,DC=local" "(objectClass=user)" -s sub cn

  • TLS certificate check:

    openssl s_client -connect dc01.example.local:636

Common Issues and Resolutions

Status not Verified

  • Cause: Network blocked between Worker Group and DC.

  • Fix: Verify DNS and port 636 or 389 from connector host. Confirm firewall rules.

Bind failed - invalid credentials

  • Cause: Wrong service account or password.

  • Fix: Verify UPN and password. Test ldapsearch from connector host.

Certificate validation errors

  • Cause: Internal CA used by LDAPS not trusted.

  • Fix: Paste root CA PEM into the Root CA (PEM) field in the SailPoint Entro integration form.

Partial object visibility

  • Cause: Service account lacks permission to read specific OUs or attributes.

  • Fix: Grant read access or check attribute-level restrictions. Ensure LDAP queries have appropriate base DN.

Time skew errors

  • Cause: Large clock drift between connector and DC.

  • Fix: Sync time via NTP.

Throttling or size limits

  • Cause: Very large AD forests causing long queries.

  • Fix: Use Worker Group with sufficient resources. Consider staged sync windows.

Advanced Diagnostics

  • Enable debug logs on the Worker Group and collect connector logs.

  • Capture packet trace (tcpdump) on connector host to verify LDAPS handshake.

  • Export SailPoint Entro connector log bundle and attach to support ticket.

Support

If validation continues to fail, contact SailPoint Entro Support:

  • Slack or Teams channel for your customer success manager

  • support@entro.security

  • Provide connector logs and the connector log bundle when contacting support to expedite troubleshooting.

Security & Compliance Notes

  • Maintain read-only service account.

  • Use LDAPS and TLS 1.2+.