in order to integrate microsoft sharepoint online and sailpoint
I’m using Entra ID as my identity service
after setting up the app in app registration, generating the certificate, I try to configure the connector on sailpoint exactly as mentioned in the documentation. However, when I try to save the application or test the connection, I always get the following error.
Illegal pattern character ‘j’
Network connectivity between sharepoint, sailpoint and Entra ID is ok.
I’ve tried several things but nothing works and I always get this error.
Can you please advise on :
whether the mentioned documentation is correct and is the good one to use for this version of SP
what could be done to resolve the error I’m getting
if everything works well, SP should be able to send a client assertion to Entra ID first, right?
I tried to capture the requests, and a trace shows that sailpoint is apparently sending a post request to itself and nothing happens after that, so it seems like it’s unable to form a JWT client assertion to Entra ID.
I have obfuscated the SP domain
@ameniii Please enable connector logs and try again. This should capture detailed logs from the connector as well to help you with troubleshooting. Please share here as well.
I checked the logs and issue is
" ApplicationDefinitionUtil.processPrivateKeyInfo() extracts the certificate’s Not After expiry date, then mistakenly passes that date value as the pattern argument to new SimpleDateFormat(pattern). The expiry date string contains j (valid in DateTimeFormatter but illegal in SimpleDateFormat), causing the crash on save."
fix: Try below
the crash is in processPrivateKeyInfo() which processes the private key you uploaded. The fix is to convert your private key to PKCS#8 unencrypted PEM format, as that is what the SharePoint Online connector expects.
Then in the IIQ SharePoint Online connector configuration, re-upload private_pkcs8.key as the private key and save.
The connector’s processPrivateKeyInfo() parses the key header to extract metadata including the certificate expiry date. If the key is in PKCS#1 format (the default openssl genrsa output), that parsing produces a string the code mishandles as a SimpleDateFormat pattern.
I ran the command
openssl pkcs8 -topk8 -nocrypt -in your_private.key -out private_pkcs8.key
on my private key, but I still get the same error.
This is the sequence of commands I used (I used the first 3 commands that were mentioned in the sailpoint documentation and added the 4th one you told me to run)
and the output of the 3rd command is a key that has this format (I noticed that it starts with “Begin private key”, whereas on the sailpoint doc, the key format start with “Begin RSA private key”. So I’m confused which one is correct).
Hello Ameni. Your trace shows fr-FR in the browser language header. Since the exception is coming from Java date-pattern processing, could you temporarily switch the browser or IIQ language to English, log out, log back in, and try saving again with the same certificate and private key?
If it works in English, that would strongly indicate the locale is triggering the issue. I would then raise a SailPoint Support case with both test results, French failing and English working, since the permanent resolution may require a SailPoint patch or supported workaround in processPrivateKeyInfo().
I would not keep converting the key either. PKCS#8 was already tested and the same error remained. The certificate commands you followed are the same ones in SailPoint’s SharePoint Online connector documentation, so the setup steps do not appear to be the issue here.
Thanks for testing, Ameni. Since changing the browser language made no difference, the browser locale is probably not the cause. The Tomcat JVM locale may still be worth checking. If possible, please confirm the running JVM values for user.language, user.country, and java.locale.providers, rather than only checking the server OS language.
This stack trace is enough to show where it fails. testConnectorAction() calls processPrivateKeyInfo(), and the exception occurs there before the SharePoint connector can build the JWT or contact Entra ID. Because of that, additional connector TRACE logging is unlikely to show anything useful.
I would not keep converting the key either, since PKCS#8 was already tested and the same error remained. At this stage, I would open a SailPoint Support case and ask whether there is a hotfix or supported patch for the Illegal pattern character 'j' failure in ApplicationDefinitionUtil.processPrivateKeyInfo() on IIQ 8.5p1.
