AD provision error

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.5

We are getting below error while users are getting provision to AD but the issue seems to be intermittent. Can anyone suggest how to resolve this.

Failed to connect to IQService. Please check TLS configuration for IQService: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

2

Hi @lsaipriya26 - This is a certificate issue. Do you have multiple task servers? If so, then one or more of them does not have the valid cert for the IQService host. I would suggest doing a Test Connection from each individual server to identify which one is missing the certificate. TLS requires a certificate for the secure connection.

3

Hi @lsaipriya26,

Above error related to certificate. It is not able to find the certificate path. Kindly add the certificate and restart the server. Hope it will works.

Thank you,

Harikrishna.

4

Hello Saipriya. As Ryan suggested, if you have multiple IIQ servers processing provisioning, please run Test Connection from each server individually. That will tell you which server is failing.

On the failing server, the fix is straightforward. The JVM running IIQ does not trust the certificate that IQService is presenting. You need to import that certificate (and its CA chain, if it is CA-signed) into the truststore that IIQ is actually using on that server.

One common issue here: if the server has more than one Java installation, make sure you are importing into the one that Tomcat/IIQ is running on. If the certificate goes into a different JRE, IIQ will not pick it up. After importing, restart the application server on that node and run Test Connection again.

If only one node is failing, comparing its Java and truststore setup with a working node is usually the quickest way to spot what is missing.

The Securing Communication Path guide and the IQService Troubleshooting page on Compass cover the full truststore setup for this.

5

Yes, This error comes due to the certificate, please check if the certificate between your iiq server, and sailpoint servers are updated and not expired. if not installed, please make sure the certificate needs to be installed on all the nodes.

6

@lsaipriya26 It’s definitely certificate related. IIQ application server’s Java trust store (cacerts) does not contain the certificate (or the full certificate chain) of the IQService host. When TLS is enabled for IQService communication, Java needs to validate the entire certificate chain. You might want to check few things.

  • Multiple IQService instances behind a load balancer — some have valid certificates in the trust store, others don’t
  • Multiple Domain Controllers — IIQ connects to different DCs, and not all DC certificates are imported into the Java trust store
  • Certificate renewal happened on some servers — new certificates were issued but not yet imported into the IIQ trust store
  • Network/timeout issues — occasional TLS handshake failures due to network latency or connection drops

You might want to try this:

  • Export the IQService certificate
  • Import into the Java trust store on the IIQ server
  • If the IQService certificate is signed by an internal CA, you must also import the Root CA and any Intermediate CA certificates into the trust store
  • Restart the application server and validate it.
7

Hi @lsaipriya26

As @ryan_toornburg mentioned, this error indicates that IdentityIQ is unable to establish a trusted SSL/TLS connection with IQService, so it’s a certificate trust issue rather than an AD provisioning issue.

If you have multiple IIQ servers, run Test Connection from each server to identify the failing node. On that server, ensure the IQService certificate and its complete CA chain are imported into the same Java truststore used by IIQ/Tomcat, then restart the application server and test again. If only one node is affected, comparing its Java and truststore configuration with a working node should quickly identify the difference.