[ConnectorError] Webservice Aggregation Error

Identity Security Cloud (ISC) ISC Discussion and Questions
4

Hi @AllIT,

The error [ConnectorError] WebserviceConnector.ts KeyID cannot be empty indicates that the value for the attribute designated as the Account ID in your source’s schema is null or empty for one or more of the records being aggregated. This is typically caused by an incorrect response mapping configuration for the Account ID attribute in your Web Services connector’s account aggregation operation.

Root Cause

In SailPoint, every account must have a unique and non-null Account ID. The Web Services connector relies on the response mapping to extract the Account ID from the API response and map it to the corresponding schema attribute. If the response mapping for the Account ID attribute is not configured correctly, or if the API returns a null or empty value for the Account ID, the aggregation will fail with the “KeyID cannot be empty” error.

Step-by-Step Troubleshooting

To resolve this issue, you need to verify your schema configuration and response mapping:

  1. Verify Account Schema Configuration:

    • Navigate to Admin > Connections > Sources and select your Web Services source.
    • In the Account Management section, select Account Schema.
    • Ensure that you have an attribute designated as the Account ID. This attribute must be unique and non-null for every account.

  2. Verify Response Mapping:

    • In your Web Services source configuration, navigate to the HTTP Operations section and select your account aggregation operation.
    • Go to the Response Mapping section.
    • Verify that the schema attribute designated as the Account ID is correctly mapped to the corresponding attribute in the API response.
    • Ensure that the Attribute Path for the Account ID is correct. The attribute path is a JSONPath or XPath expression that points to the location of the Account ID in the API response.

  3. Test API Response:

    • Use a tool like Postman to execute the same API request that the Web Services connector is using for account aggregation.
    • Examine the API response and verify that the field you have mapped to the Account ID contains a unique, non-null value for every record.

  4. Validate Response Structure and Root Path:

    • In the Response Information section of your account aggregation operation, verify that the Root Path is correctly configured. The Root Path is a common path for all attributes in the response.
    • The final JSONPath or XPath for an attribute is a combination of the Root Path and the Attribute Path. Ensure that this combined path correctly resolves to the location of the Account ID in the API response.

Solution Options

Based on the troubleshooting steps above, here are the most common solutions:

  • Solution A: Correct the Response Mapping

    • If the response mapping for the Account ID is incorrect, update the Attribute Path to correctly point to the Account ID in the API response.

  • Solution B: Update the Account Schema

    • If you have not designated an Account ID in your schema, edit the schema to mark the appropriate attribute as the Account ID.

  • Solution C: Address Null Values in the API Response

    • If the API is returning null or empty values for the Account ID, you will need to address this issue in the source application. All accounts must have a unique and non-null Account ID.

Documentation References

  1. Managing Source Account Schemas
  2. Response Mapping
  3. Response Information
  4. Aggregation
  5. Source Account Schema Best Practices

Best Practice Note

It is a best practice to always validate your API responses with a tool like Postman before configuring your Web Services connector. This will help you to ensure that your response mapping is correct and that your API is returning the expected data.