An error occurred while aggregating Application Active Directory [source]

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

My Active Directory connector was working fine on Friday, but has stopped provisioning accounts this morning. I CAN still manually aggregate all accounts, single accounts, enable and disable individual accounts via SP.

This is the full error message:

Error generating a unique value, the exception was:
java.lang.Exception: Unable to contact connector to generate unique value and is not retry-able. Action:LDAPUniqueValueValidator: Searching for objectType 'account' using options '{deltaAggregation=false, cloudConfigOverrides={aggregateTimeout=30, deltaIterationMode=NONE, disablePooling=true, timeout=30, iterateSearchFilter=(&(sAMAccountName=tbrace91))}}' on source 'Active Directory [source]'. Exception: java.lang.RuntimeException: An error occurred while aggregating Application Active Directory [source]

Has anyone come across this type of error before?
Many thanks
Phil

2

Hi @phil_awlings,

Please check the filter that you are applying whether that is returning correct data or not.
Please see if this discussion helps.

Thanks

3

Iā€™ve rolled back the CREATE settings to the last save point, and checked the source configuration.
It appears that it is just the LDAP query which is failing which comes from this attribute rule inside the ā€˜account CREATEā€™:

{
            "name": "sAMAccountName",
            "transform": {
                "type": "rule",
                "attributes": {
                    "name": "Create Unique LDAP Attribute"
                }
            }
4

Issue is resolved or you want help with the rule?

Thanks

5

The issue is not resolved, and I donā€™t understand why it has stopped working.
All settings were unchanged over the weekend.
Its an OOB connector so the search settings (apart from the sAMAccountName) are preset.
And as I said in my original statement, I can manually aggregate the source for both individual and bulk accounts

6

Hi @phil_awlings,

Are you facing issue during account creation? If it is with creation, then what all changes you did after it started failing?

Is it during aggregation you are facing issue?

Thanks

7

It is just during the account creation process:
Iā€™ve:

  • rolled back the configuration of the CREATE function to a saved point,
  • checked the schema,
  • checked the configuration file against the saved Master copy
  • rebooted the server that the AD is stored on.
  • gone onto the server and checked its configuration and navigated around
  • manually aggregate all accounts and entitlements (they work fine)
  • manually aggregated a single account. (that works)
  • enable and disabled a single account (that works)
  • checked the dashboard for any ā€˜hungā€™ processes

About to manually change some identity attributes to see if the sync process is working, then I am at a loss after that

Edit: sync process for updating attributes works.

8

Hi @phil_awlings,

What are the changes in account creation step?
Also, please share account creation rule ā€œCreate Unique LDAP Attributeā€.

Thanks

9

Hi @phil_awlings,

Did you change the search filter to include only a single user.?

The error indicates the filter as SearchFilter=(&(sAMAccountName=tbrace91))

If yes, can you revert that to the previous settings and see if it works. I believe the rule looks into AD through the search filter defined in the connector configuration.

10

ā€œCreate Unique LDAP Attributeā€ is a Sailpoint Rule, not something that was created bespoke for us.

Account Profile Attribute Generator (from Template) | SailPoint Developer Community

11

Hi @jesvin90 ,

No changes made by me. Its a Sailpoint rule. and it needs to only look at a single user for a uniqueness check. Hereā€™s the whole of the attribute :

{
    "name": "sAMAccountName",
    "transform": {
        "type": "rule",
        "attributes": {
            "name": "Create Unique LDAP Attribute"
        }
    },
    "attributes": {
        "template": "$(samaccountnameCalculate)$(uniqueCounter)",
        "cloudMaxUniqueChecks": "10",
        "cloudMaxSize": "20",
        "cloudRequired": "true"
    },
    "isRequired": false,
    "type": "string",
    "isMultiValued": false
}
12

Not sure if youā€™ve already seen it, but thereā€™s an outage posted on the Sailpoint Status page on this:

4 Likes
13

EDIT: Fixed my own error

14

Follow up question:
This is the error message that I was meant to be working on this morning for account creation:

Account created but failed to modify : Failed to update attributes for identity CN=tbrent44,OU=Teaching Staff,OU=Users,OU=2046677,OU=Primary,OU=Schools,DC=edpoc,DC=net. The specified directory service attribute or value does not exist.

Do we think that this is related?
All attributes that I am trying to create are in the schema

15

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.