# AI-Driven Identity Security Configuration - Failed **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** ai, identityiq, sailpoint-identity-security\ **Created:** [May 7, 2026, 3:26pm UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132 "2026-05-07T15:26:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\ **Post date:** [May 7, 2026, 3:26pm UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/1 "2026-05-07T15:26:44Z")
> ‼ Please be sure you’ve read the [docs](https://developer.sailpoint.com/idn/docs/) and [API specs](https://developer.sailpoint.com/idn/api/getting-started) before asking for help. Also, please be sure you’ve [searched](https://developer.sailpoint.com/discuss/search?expanded=true) the forum for your answer before you create a new topic. ## Please consider addressing the following when creating your topic: - Tried to configure **AI-Driven Identity Security** in IIQ to integrate the ISC tenant for recommendation and GenAI, however I am getting an error. **`GenAI failed to connect: Failed to connect with OAuth token provider at host ``https://xxxxxx.api.identitynow-demo.com`` : javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target`** - Configurations are correct, client id and secret is working fine via postman. ![image](https://global.discourse-cdn.com/sailpoint/original/3X/7/c/7c0cb3910e3d5f7f4d5e53dab4670a14f63717bc.png) Regards, Kannan ---
**Author:** ![ryan\_toornburg](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ryan_toornburg/32/21550_2.png) [@ryan\_toornburg](https://developer.sailpoint.com/discuss/u/ryan_toornburg)\ **Post date:** [May 7, 2026, 4:32pm UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/2 "2026-05-07T16:32:13Z")
Hi @kannan_sb85 - It can’t find the cert for some reason. Are you going through a proxy? One thing you may try is exporting the cert from your tenant url. Click the lock in your browser bar next to https and export that certificate. Then import it into your keystore. ---
**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\ **Post date:** [May 7, 2026, 6:59pm UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/3 "2026-05-07T18:59:19Z")
Hi Ryan, I have not using the proxy, the tenant is demo only from the Ambassador and when I checked the certificate it is still valid till july 2026. I have imported the certificate in the keystore, still it is not working, is there any solution or does it related with the tenant issue? The GenAI testconnection is working, but not the AI-Driven Configuration ![image](https://global.discourse-cdn.com/sailpoint/original/3X/c/a/cabed23f3ef43df4a8cc57ebc9f6d839c5838166.png) Regards, Kannan ---
**Author:** ![mandarsane](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mandarsane/32/35650_2.png) [@mandarsane](https://developer.sailpoint.com/discuss/u/mandarsane)\ **Post date:** [May 8, 2026, 6:38am UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/4 "2026-05-08T06:38:59Z")
Hi @kannan_sb85 , Where is IIQ server hosted from where you are trying to connect to ISC functionality? If it is in organization environment, probably it needs additional configuration for certification and blocking connection. You can try same thing first from your personal IIQ server and see outcome. ---
**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\ **Post date:** [May 11, 2026, 1:04pm UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/5 "2026-05-11T13:04:57Z")
Unfortunately, there is still no success I am getting the same connection failed error 401. what is confusing is that the GenAI test connection works using the same client ID, secret, and endpoint. Despite that, the main connection continues to fail, which makes the issue quite challenging. ![image](https://global.discourse-cdn.com/sailpoint/original/3X/0/6/067ddea11734e273a758b295ca2b1ce56a76cfdb.png) ![image](https://global.discourse-cdn.com/sailpoint/original/3X/f/8/f8dd6ac0d7076802feebb02754ac85fbec2e6bad.png) Regards, Kannan ---
**Author:** ![santhirajumunganda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/santhirajumunganda/32/42744_2.png) [@santhirajumunganda](https://developer.sailpoint.com/discuss/u/santhirajumunganda)\ **Post date:** [May 12, 2026, 6:05am UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/6 "2026-05-12T06:05:29Z")
Hi @kannan_sb85, I had seen a very similar issue a few months back In that case, configuring only the API Management Client ID/Secret in ISC was not enough for the complete AI-Driven Identity Security setup. Since your GenAI Test Connection is already working, it looks like the credentials and endpoint are probably correct 👍 You may want to verify whether the remaining ISC-side onboarding steps are also completed, especially things like: - Creating an IdentityIQ Data Source for Connectivity with AI-Driven Identity Security - Configuring IdentityIQ for Access Modeling - Generating Client Credentials in Your Tenant - Importing the init-ai.xml File - Configuring AI-Driven Identity Security in IdentityIQ - Installing the Access Modeling Plugin - Configuring Automatic Role Creation in IdentityIQ - Integrating Access Recommendations for IdentityIQ Of course, you may already have some of these configured, but based on the behavior and the 401 during the main integration flow, it might be worth double-checking those sections once. The official guide explains the remaining setup steps very well: [AI-Driven Identity Security for IIQ Setup Guide](https://documentation.sailpoint.com/saas/help/ai/iiq/iiq_ai_get_started.html?utm_source=chatgpt.com) Especially: - Deploying the Virtual Appliance - Creating an IdentityIQ Data Source Hopefully this helps point things in the right direction. Thanks Raju :expert_ambassador: ---
**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\ **Post date:** [May 12, 2026, 6:22am UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/7 "2026-05-12T06:22:14Z")
@santhirajumunganda - Thanks Raju. I was tried and followed this guide and in my demo tenant I could not see that data source to add that up. Is there something issue with my tenant or I missed any configuration in specific? ![image](https://global.discourse-cdn.com/sailpoint/original/3X/f/4/f4434b51f0d84f1d1e7bf0dda4c7ce768963bd1e.png) Regards, Kannan ---
**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\ **Post date:** [May 12, 2026, 6:27am UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/8 "2026-05-12T06:27:44Z")
You need to connect with Sailpoint to create the Data Sources here. Please connect with your CSM for more details on the same. ---
**Author:** ![santhirajumunganda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/santhirajumunganda/32/42744_2.png) [@santhirajumunganda](https://developer.sailpoint.com/discuss/u/santhirajumunganda)\ **Post date:** [May 12, 2026, 6:48am UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/9 "2026-05-12T06:48:54Z")
Yes, you can check once with the Developer Relations team. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [July 11, 2026, 6:48am UTC](https://developer.sailpoint.com/discuss/t/ai-driven-identity-security-configuration-failed/207132/10 "2026-07-11T06:48:59Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.