Error when aggregating Salesforce

vic_rinkenberger · July 27, 2026, 7:13pm

Which IIQ version are you inquiring about?

8.4

Share all details about your problem, including any error messages you may have received.

*When aggregating Salesforce in Production, I’m getting this error:

2026-07-27T14:32:35,205 ERROR QuartzScheduler_Worker-4 sailpoint.connector.salesforce.ForceAggregationHandler:415 - Exception while aggregation : 
connector.sdk.webservices.exception.WebServicesSdkException: <?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.partner.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><soapenv:Fault><faultcode>sf:INVALID_SESSION_ID</faultcode><faultstring>INVALID_SESSION_ID: This session is not valid for use with the API</faultstring><detail><sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault"><sf:exceptionCode>INVALID_SESSION_ID</sf:exceptionCode><sf:exceptionMessage>This session is not valid for use with the API</sf:exceptionMessage></sf:UnexpectedErrorFault></detail></soapenv:Fault></soapenv:Body></soapenv:Envelope>
	at connector.sdk.webservices.ExecutionMediator.processEndpoint(ExecutionMediator.java:646) ~[connector-bundle-webservices.jar:8.4p1]

This error did not show up when connecting to a Dev Salesforce environment. I’m unsure if this is something that is expected and just needs to be updated in Salesforce, or if there is a larger issue that needs fixed.*

Any thoughts?

naveenkumar3 · July 28, 2026, 1:09am

Vic Rinkenberger:

*When aggregating Salesforce in Production, I’m getting this error:

2026-07-27T14:32:35,205 ERROR QuartzScheduler_Worker-4 sailpoint.connector.salesforce.ForceAggregationHandler:415 - Exception while aggregation : 
connector.sdk.webservices.exception.WebServicesSdkException: <?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.partner.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><soapenv:Fault><faultcode>sf:INVALID_SESSION_ID</faultcode><faultstring>INVALID_SESSION_ID: This session is not valid for use with the API</faultstring><detail><sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault"><sf:exceptionCode>INVALID_SESSION_ID</sf:exceptionCode><sf:exceptionMessage>This session is not valid for use with the API</sf:exceptionMessage></sf:UnexpectedErrorFault></detail></soapenv:Fault></soapenv:Body></soapenv:Envelope>
	at connector.sdk.webservices.ExecutionMediator.processEndpoint(ExecutionMediator.java:646) ~[connector-bundle-webservices.jar:8.4p1]

This error did not show up when connecting to a Dev Salesforce environment. I’m unsure if this is something that is expected and just needs to be updated in Salesforce, or if there is a larger issue that needs fixed.*

Any thoughts?

INVALID_SESSION_ID: This session is not valid for use with the API is typically a Salesforce-side authentication/session issue rather than an aggregation issue. Since the same configuration works against Dev but not Production, I’d verify the Production integration user permissions (especially API Enabled), OAuth/Connected App settings, session/IP restrictions, and reauthenticate the source. From the error provided, Salesforce is rejecting the API session being used by the connector.

vikaspawar0303 · July 28, 2026, 1:17am

check any scope is defined by Salesforce team for this API, and add the scope in your calling header, if there any scope defined by Salesforce team.

neel193 · July 28, 2026, 3:01am

@vic_rinkenberger could you please check your app XML in debug? There should be an entry for session id. Possibly while moving from dev to prod, this got shipped. You might want to delete that and try again.

punna0001 · July 28, 2026, 4:21am

Hello Vic. I agree with @neel193 suggestion to check the application XML for the cached Salesforce session details. SailPoint’s Salesforce connector troubleshooting docs cover this exact INVALID_SESSION_ID error. The application configuration can contain a sessionID and serverUrl, and connector operations can fail when those values are no longer valid or belong to a different Salesforce environment.

The documented fix is:

Open the application XML in debug and remove both the sessionID and serverUrl entries.
Save the application.
Run Test Connection. This forces the connector to re-authenticate and grab a fresh session and endpoint from Salesforce.
If the test passes, retry the aggregation.

Since Dev works but Production does not, it is worth checking whether these values were carried over when the application configuration was copied or migrated between environments. Removing them allows the connector to authenticate against the configured Production Salesforce instance.

If Test Connection still fails after clearing those entries, check whether the Production integration user has the API Enabled permission and verify the authentication settings for the configured method, such as the Salesforce login or My Domain URL and, when using OAuth, the applicable token URL.

vic_rinkenberger · July 28, 2026, 6:29pm

I removed the sessionId and serverUrl values and did Test Connection, but the issue still persists.

vic_rinkenberger · July 28, 2026, 6:31pm

Thanks for the ideas. The Salesforce team says that all looks good and the permissions/settings are the same between environments…

neel193 · July 29, 2026, 3:32am

@vic_rinkenberger Could you please share your app xml for review?

naveenkumar3 · July 29, 2026, 10:54am

Restart the IdentityIQ application server

The Salesforce connector caches the authenticated Connector instance — including the session ID it obtained at login — in the in‑memory ConnectorFactory cache, keyed by application. Editing/removing sessionId and serverUrl in the application XML and running Test Connection does not clear that in-memory cache — it only updates the persisted config. The runtime keeps using the stale cached session object until the JVM is restarted, which is why the error persists even after your XML edit.

Restarting the app server forces the connector to re-instantiate and perform a fresh login (username + password + security token) against Production, obtaining a new valid session ID.

can you try it??

vic_rinkenberger · July 29, 2026, 1:23pm

Yes, I tried that, but it doesn’t work.

vic_rinkenberger · July 29, 2026, 1:24pm

Here is the app XML:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Application PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Application connector="sailpoint.connector.ForceConnector" featuresString="SEARCH" icon="internetIcon" name="Salesforce" profileClass="" type="Salesforce">
  <Attributes>
    <Map>
      <entry key="OAuth2TokenURL" value="https://company.my.salesforce.com/services/oauth2/token"/>
      <entry key="PublicGroupIdentityAttributeAsDeveloperName">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>
      <entry key="afterProvisioningRule"/>
      <entry key="aggregationPartitioned">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>
      <entry key="aggregationType" value="account"/>
      <entry key="audience"/>
      <entry key="auth_type" value="OAuth2"/>
      <entry key="beforeProvisioningRule" value="Rule1"/>
      <entry key="clientId"/>
      <entry key="clientSecret"/>
      <entry key="compositeDefinition"/>
      <entry key="createContacts">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="customTimeOut"/>
      <entry key="encrypted" value="clientSecret, private_key, privateKeyPassword, refreshToken"/>
      <entry key="excludeFrozen">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="grant_type" value="refresh_token"/>
      <entry key="isActive">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="issuer"/>
      <entry key="nativeChangeDetectionAttributeScope" value="entitlements"/>
      <entry key="nativeChangeDetectionAttributes"/>
      <entry key="nativeChangeDetectionEnabled">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="nativeChangeDetectionOperations"/>
      <entry key="password"/>
      <entry key="privateKeyPassword"/>
      <entry key="privateKeyUploadedOn"/>
      <entry key="private_key"/>
      <entry key="private_key_to_update"/>
      <entry key="refreshToken"/>
      <entry key="serverUrl"/>
      <entry key="sessionId"/>
      <entry key="subject"/>
      <entry key="sysDescriptions">
        <value>
          <Map>
            <entry key="en_US"/>
          </Map>
        </value>
      </entry>
      <entry key="templateApplication" value="Salesforce Template"/>
      <entry key="url" value="https://login.salesforce.com/services/Soap/u/"/>
      <entry key="user" value="user@domain.com"/>
    </Map>
  </Attributes>
  <Owner>
    <Reference class="sailpoint.object.Identity" name="Salesforce Team"/>
  </Owner>
  <ProvisioningConfig deleteToDisable="true"/>
  <ProvisioningForms>
    <Form name="account" objectType="account" type="Create">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="account"/>
        </Map>
      </Attributes>
      <Section>
        <Field displayName="con_prov_policy_salesforce_direct_Alias" name="Alias" required="true" type="string">
          <Description> Take first letter of first name and squish it together for an 8 character alias.  Otherwise use first 8 characters of the identity's name.</Description>
          <Script>
            <Source>
              String first = identity.getFirstname();
              String last = identity.getLastname();

              if (last == null) {
                last = identity.getName();
              }

              String alias = null;
              int max = 7;

              if (last.length() &lt; max) {
                max = last.length();
              }

              if (first != null) {
                alias = first.charAt(0) + last.substring(0, max);
              } else {
                if (last.length() &lt; 8) {
                  max = last.length();
                }
                alias = last.substring(0, max);
              }

              return alias;
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Active" name="IsActive" required="true" type="boolean" value="true"/>
        <Field displayName="con_prov_policy_salesforce_direct_Username" helpKey="help_prov_policy_salesforce_direct_Username" name="Username" required="true" type="string">
          <Script>
            <Source>
              return identity.getAttribute("att1") + "@company.com";
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Email" helpKey="help_prov_policy_salesforce_direct_Email" name="Email" required="true" type="string">
          <Script>
            <Source>
              return identity.getEmail();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_FirstName" name="FirstName" required="true" type="string">
          <Script>
            <Source>
              return identity.getFirstname();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_LastName" name="LastName" required="true" type="string">
          <Script>
            <Source>
              return identity.getLastname();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_NickName" name="CommunityNickname" required="true" type="string">
          <Script>
            <Source>
              return identity.getFullName();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_TimeZone" name="TimeZoneSidKey" required="true" type="string" value="America/Los_Angeles">
          <AllowedValuesDefinition>
            <Value>
              <List>
                <String>America/Chicago</String>
                <String>America/Bogota</String>
                <String>America/Lima</String>
                <String>America/Los_Angeles</String>
                <String>Atlantic/Bermuda</String>
              </List>
            </Value>
          </AllowedValuesDefinition>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Locale" name="LocaleSidKey" required="true" type="string" value="en_US"/>
        <Field displayName="con_prov_policy_salesforce_direct_LanguageLocaleKey" name="LanguageLocaleKey" required="true" type="string" value="en_US"/>
        <Field displayName="con_prov_policy_salesforce_direct_EmailEncodingKey" name="EmailEncodingKey" required="true" type="string" value="UTF-8"/>
        <Field displayName="con_prov_policy_salesforce_direct_FederationIdentifier" name="FederationIdentifier" required="true" type="string">
          <Script>
            <Source>return identity.getAttribute("att1");</Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_UserType" helpKey="help_con_form_salesforce_usertype" name="UserType" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_AccountName" helpKey="help_con_form_salesforce_accountname" name="AccountName" type="string"/>
        <Field name="jobId" required="true" type="string">
          <Script>
            <Source>
              return identity.getAttribute("jobId");
            </Source>
          </Script>
        </Field>
        <Field name="CallCenterId" type="string" value=""/>
      </Section>
    </Form>
    <Form name="Create PublicGroups" objectType="PublicGroups" type="Create">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="Create PublicGroups"/>
        </Map>
      </Attributes>
      <Section>
        <Field displayName="con_prov_policy_salesforce_direct_Name" helpKey="Public Group Name." name="Name" required="true" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_DeveloperName" helpKey="It is unique name for the Public Group. This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores." name="DeveloperName" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_DoesIncludeBosses" helpKey="Indicates whether the managers have access (true) or do not have access (false) to records shared with members of the group." name="DoesIncludeBosses" reviewRequired="true" type="boolean" value="true"/>
      </Section>
    </Form>
    <Form name="Update PublicGroups" objectType="PublicGroups" type="Update">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="Update PublicGroups"/>
        </Map>
      </Attributes>
      <Section>
        <Field displayName="con_prov_policy_salesforce_direct_Id" helpKey="Public Group Id." name="Id" reviewRequired="true" type="string">
          <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Name" helpKey="Public Group Name." name="Name" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_DeveloperName" helpKey="It is unique name for the Public Group.This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores." name="DeveloperName" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_OwnerId" helpKey="ID of the user who owns the group." name="OwnerId" reviewRequired="true" type="string">
          <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_DoesIncludeBosses" helpKey="Indicates whether the managers have access (true) or do not have access (false) to records shared with members of the group." name="DoesIncludeBosses" reviewRequired="true" type="boolean"/>
      </Section>
    </Form>
    <Form name="update" objectType="account" type="Update">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="update"/>
        </Map>
      </Attributes>
      <Section name="Section 1">
        <Field name="jobId" type="string">
          <Script>
            <Source>
              return identity.getAttribute("jobId");
            </Source>
          </Script>
        </Field>
      </Section>
    </Form>
    <Form name="Disable Account" objectType="account" type="Disable">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="Disable Account"/>
        </Map>
      </Attributes>
      <Section name="Section 1"/>
    </Form>
  </ProvisioningForms>
  <Schemas>
    <Schema created="1785271916152" displayAttribute="Username" id="0a116bce9faa1ee4819faa7f96780102" identityAttribute="Id" instanceAttribute="" nativeObjectType="User" objectType="account" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Internal salesforce id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Alias" type="string">
        <Description>User's assigned alias.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="City" type="string">
        <Description>User's city.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="CommunityNickname" type="string">
        <Description>DisplayNames for user's online communities.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="CompanyName" type="string">
        <Description>User's company name.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" name="CallCenterId" type="string">
        <Description>User's call center.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Country" type="string">
        <Description>User's country.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Department" type="string">
        <Description>User's department.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Email" type="string">
        <Description>User's Email address.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Division" type="string">
        <Description>User's division.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="EmployeeNumber" type="string">
        <Description>User's employee number.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Extension" type="string">
        <Description>User's telephone extension.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Street" type="string">
        <Description>The street address associated with the User.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Fax" type="string">
        <Description>User's fax number.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="IsActive" type="boolean">
        <Description>Flag that indicates if the user is active in Salesforce.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="IsFrozen" type="boolean">
        <Description>Flag that indicates if the user is frozen in Salesforce.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Username" type="string">
        <Description>Contains the name that a user enters to log into the API or the user interface.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="FirstName" type="string">
        <Description>User's first name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="LastName" type="string">
        <Description>User's last name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="EmailEncodingKey" type="string">
        <Description>Encoding that should be used during email communications.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>User's fullname.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserPermissionsMarketingUser" type="boolean">
        <Description>Maps to the Marketing User Flag.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserPermissionsOfflineUser" type="boolean">
        <Description>Maps to the Offline user Flag.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserPermissionsSFContentUser" type="boolean">
        <Description>Maps to Sales Anywhere User.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Phone" type="string">
        <Description>User's phone number.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" name="ProfileId" schemaObjectType="group" type="string">
        <Description>ID of the profile assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ProfileName" type="string">
        <Description>Name of the profile assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="PublicGroups" schemaObjectType="PublicGroups" type="string">
        <Description>Public groups are the entitlements for user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="QueueNames" type="string">
        <Description>Queues assigned to the user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ReceivesAdminInfoEmails" type="string">
        <Description>Receive the salesforce.com administrator newsletter.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" name="Role" schemaObjectType="Role" type="string">
        <Description>The Role assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserType" type="string">
        <Description>This is user type of salesforce user i.e Standard, Partner, AutomatedProcess.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="State" type="string">
        <Description>User's state.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Title" type="string">
        <Description>User's title.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ReceivesInfoEmails" type="string">
        <Description>Receive the salesforce.com newsletter.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" multi="true" name="PermissionSet" schemaObjectType="PermissionSet" type="string">
        <Description>PermissionSet assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" multi="true" name="PermissionSetGroup" schemaObjectType="PermissionSetGroup" type="string">
        <Description>PermissionSetGroup assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="PermissionSetLicense" schemaObjectType="PermissionSetLicense" type="string">
        <Description>PermissionSetLicense assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="ManagedPackage" schemaObjectType="ManagedPackage" type="string">
        <Description>Managed Package assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="CollaborationGroup" schemaObjectType="CollaborationGroup" type="string">
        <Description>Collaboration Group Id assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserLicense" remediationModificationType="None" type="string">
        <Description>User's license.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="LanguageLocaleKey" type="string">
        <Description>The user's language.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="LocaleSidKey" type="string">
        <Description>This is the user's locale.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="TimeZoneSidKey" type="string">
        <Description>The timezone of the user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="FederationIdentifier" type="string">
        <Description>A Federation IDs is an identifier that is unique within a salesforce Organization.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ManagerId" type="string">
        <Description>User's manager id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="jobId" type="string">
        <Description>Workday Job Code</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="" displayAttribute="Name" id="0a116bce9faa1ee4819faa7f96780109" identityAttribute="Id" instanceAttribute="" nativeObjectType="Role" objectType="Role" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Role Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Role name.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="" displayAttribute="NamespacePrefix" id="0a116bce9faa1ee4819faa7f9678010a" identityAttribute="Id" instanceAttribute="" nativeObjectType="ManagedPackage" objectType="ManagedPackage" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Managed Package Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="NamespacePrefix" type="string">
        <Description>Managed Package NamespacePrefix.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="" displayAttribute="Name" featuresString="PROVISIONING" id="0a116bce9faa1ee4819faa7f96780105" identityAttribute="Id" instanceAttribute="" nativeObjectType="PublicGroups" objectType="PublicGroups" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Public Group Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Public Group Name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="DeveloperName" type="string">
        <Description>It is unique name for the Public Group</Description>
      </AttributeDefinition>
      <AttributeDefinition name="DoesIncludeBosses" type="boolean">
        <Description>Indicates whether the managers have access (true) or do not have access (false) to records shared with members of the group</Description>
      </AttributeDefinition>
      <AttributeDefinition name="OwnerId" type="string">
        <Description>ID of the user who owns the group.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="Description" displayAttribute="Name" id="0a116bce9faa1ee4819faa7f96780104" identityAttribute="Id" instanceAttribute="" nativeObjectType="CollaborationGroup" objectType="CollaborationGroup" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Collaboration Group Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Collaboration Group Name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="CollaborationType" type="string">
        <Description>Collaboration Group Type.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="Description" displayAttribute="Label" id="0a116bce9faa1ee4819faa7f96780106" identityAttribute="Name" instanceAttribute="" nativeObjectType="PermissionSet" objectType="PermissionSet" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Name" type="string">
        <Description>The internal id for this group.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Label" type="string">
        <Description>The friendly name assigned to the profile.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description>Description for the profiles.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="" displayAttribute="MasterLabel" id="0a116bce9faa1ee4819faa7f96780108" identityAttribute="Id" instanceAttribute="" nativeObjectType="PermissionSetLicense" objectType="PermissionSetLicense" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>PermissionSetLicense Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="MasterLabel" type="string">
        <Description>PermissionSetLicense MasterLabel.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785271916152" descriptionAttribute="Description" displayAttribute="MasterLabel" id="0a116bce9faa1ee4819faa7f96770101" identityAttribute="Id" instanceAttribute="" nativeObjectType="PermissionSetGroup" objectType="PermissionSetGroup" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>PermissionSetGroup Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="MasterLabel" type="string">
        <Description>PermissionSetGroup Name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description>PermissionSetGroup Description.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema created="1785271916152" descriptionAttribute="Description" displayAttribute="Name" id="0a116bce9faa1ee4819faa7f96780103" identityAttribute="Id" includePermissions="true" instanceAttribute="" nativeObjectType="Profile" objectType="group" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>The internal id for this group.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>The friendly name assigned to the profile.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description>Description for the profiles.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserType" type="string">
        <Description>This is the type of profile even though the attribute name would indicate a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserLicense" remediationModificationType="None" type="string">
        <Description>User's license.</Description>
      </AttributeDefinition>
    </Schema>
  </Schemas>
  <ApplicationScorecard created="1785271916152" id="0a116bce9faa1ee4819faa7f96780107"/>
</Application>

vic_rinkenberger · July 29, 2026, 3:21pm

Oh, I just realized that this is the first error that I see, and then the INVALID_SESSION_ID error is thrown hundreds of times.

2026-07-29T10:15:26,425 ERROR QuartzScheduler_Worker-4 sailpoint.connector.salesforce.ForceAggregationHandler:415 - Exception while aggregation : 
connector.sdk.webservices.exception.WebServicesSdkException: <?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.partner.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><soapenv:Fault><faultcode>sf:INVALID_SESSION_ID</faultcode><faultstring>INVALID_SESSION_ID: Invalid Session ID found in SessionHeader: Illegal Session. Session not found, missing session hash: eb8f546ceae21f70afb04a0e3123herh09c44d6ce58ab36a88adcffec6205a01
This error usually occurs after a session expires or a user logs out. Decoder: DataInDbSessionKeyDecoder</faultstring><detail><sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault"><sf:exceptionCode>INVALID_SESSION_ID</sf:exceptionCode><sf:exceptionMessage>Invalid Session ID found in SessionHeader: Illegal Session. Session not found, missing session hash: eb8f546ceae21f70afb04a0e3123herh09c44d6ce58ab36a88adcffec6205a01
This error usually occurs after a session expires or a user logs out. Decoder: DataInDbSessionKeyDecoder</sf:exceptionMessage></sf:UnexpectedErrorFault></detail></soapenv:Fault></soapenv:Body></soapenv:Envelope>

I missed this error in my original analysis.

naveenkumar3 · July 30, 2026, 1:28am

can you check with your salesforce team to check below configuration changes, :

Session Settings → Lock sessions to the IP address from which they originated — this is an org-wide setting under Setup → Security → Session Settings in Salesforce.
Connected App → IP Relaxation — this is a per-Connected-App setting under Setup → App Manager → (your Connected App) → Edit Policies, in the OAuth Policies section, where “IP Relaxation” is set to “Enforce IP restrictions” or “Relax IP restrictions.”

vic_rinkenberger · August 3, 2026, 3:14pm

The Salesforce team is showing me screenshots that say this is all disabled/enabled as you suggest.

vic_rinkenberger · August 3, 2026, 3:18pm

Here is the XML:

```

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Application PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Application connector="sailpoint.connector.ForceConnector" created="1784660026415" featuresString="SEARCH" icon="internetIcon" id="0a116bce9f861632819f8606e42f0114" modified="1785444105208" name="Salesforce" profileClass="" type="Salesforce">
  <Attributes>
    <Map>
      <entry key="OAuth2TokenURL" value="https://company_name.my.salesforce.com/services/oauth2/token"/>
      <entry key="PublicGroupIdentityAttributeAsDeveloperName">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>
      <entry key="afterProvisioningRule"/>
      <entry key="aggregationPartitioned">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>
      <entry key="aggregationType" value="account"/>
      <entry key="audience"/>
      <entry key="auth_type" value="OAuth2"/>
      <entry key="beforeProvisioningRule" value="Rule1"/>
      <entry key="clientId"/>
      <entry key="clientSecret"/>
      <entry key="compositeDefinition"/>
      <entry key="createContacts">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="customTimeOut"/>
      <entry key="encrypted" value="clientSecret, private_key, privateKeyPassword, refreshToken"/>
      <entry key="excludeFrozen">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="grant_type" value="refresh_token"/>
      <entry key="isActive">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="issuer"/>
      <entry key="nativeChangeDetectionAttributeScope" value="entitlements"/>
      <entry key="nativeChangeDetectionAttributes"/>
      <entry key="nativeChangeDetectionEnabled">
        <value>
          <Boolean></Boolean>
        </value>
      </entry>
      <entry key="nativeChangeDetectionOperations"/>
      <entry key="password"/>
      <entry key="privateKeyPassword"/>
      <entry key="privateKeyUploadedOn"/>
      <entry key="private_key"/>
      <entry key="private_key_to_update"/>
      <entry key="refreshToken"/>
      <entry key="serverUrl"/>
      <entry key="sessionId"/>
      <entry key="subject"/>
      <entry key="sysDescriptions">
        <value>
          <Map>
            <entry key="en_US"/>
          </Map>
        </value>
      </entry>
      <entry key="templateApplication" value="Salesforce Template"/>
      <entry key="url" value="https://login.salesforce.com/services/Soap/u/"/>
      <entry key="user" value="user@domain.com"/>
    </Map>
  </Attributes>
  <Owner>
    <Reference class="sailpoint.object.Identity" id="" name=""/>
  </Owner>
  <ProvisioningConfig deleteToDisable="true"/>
  <ProvisioningForms>
    <Form name="account" objectType="account" type="Create">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="account"/>
        </Map>
      </Attributes>
      <Section>
        <Field displayName="con_prov_policy_salesforce_direct_Alias" name="Alias" required="true" type="string">
          <Description> Take first letter of first name and squish it together for an 8 character alias.  Otherwise use first 8 characters of the identity's name.</Description>
          <Script>
            <Source>
              String first = identity.getFirstname();
              String last = identity.getLastname();

              if (last == null) {
                last = identity.getName();
              }

              String alias = null;
              int max = 7;

              if (last.length() &lt; max) {
                max = last.length();
              }

              if (first != null) {
                alias = first.charAt(0) + last.substring(0, max);
              } else {
                if (last.length() &lt; 8) {
                  max = last.length();
                }
                alias = last.substring(0, max);
              }

              return alias;
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Active" name="IsActive" required="true" type="boolean" value="true"/>
        <Field displayName="con_prov_policy_salesforce_direct_Username" helpKey="help_prov_policy_salesforce_direct_Username" name="Username" required="true" type="string">
          <Script>
            <Source>
              return identity.getAttribute("att1") + "@company_name.com";
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Email" helpKey="help_prov_policy_salesforce_direct_Email" name="Email" required="true" type="string">
          <Script>
            <Source>
              return identity.getEmail();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_FirstName" name="FirstName" required="true" type="string">
          <Script>
            <Source>
              return identity.getFirstname();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_LastName" name="LastName" required="true" type="string">
          <Script>
            <Source>
              return identity.getLastname();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_NickName" name="CommunityNickname" required="true" type="string">
          <Script>
            <Source>
              return identity.getFullName();
            </Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_TimeZone" name="TimeZoneSidKey" required="true" type="string" value="America/Los_Angeles">
          <AllowedValuesDefinition>
            <Value>
              <List>
                <String>America/Chicago</String>
                <String>America/Bogota</String>
                <String>America/Lima</String>
                <String>America/Los_Angeles</String>
                <String>Atlantic/Bermuda</String>
              </List>
            </Value>
          </AllowedValuesDefinition>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Locale" name="LocaleSidKey" required="true" type="string" value="en_US"/>
        <Field displayName="con_prov_policy_salesforce_direct_LanguageLocaleKey" name="LanguageLocaleKey" required="true" type="string" value="en_US"/>
        <Field displayName="con_prov_policy_salesforce_direct_EmailEncodingKey" name="EmailEncodingKey" required="true" type="string" value="UTF-8"/>
        <Field displayName="con_prov_policy_salesforce_direct_FederationIdentifier" name="FederationIdentifier" required="true" type="string">
          <Script>
            <Source>return identity.getAttribute("att1");</Source>
          </Script>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_UserType" helpKey="help_con_form_salesforce_usertype" name="UserType" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_AccountName" helpKey="help_con_form_salesforce_accountname" name="AccountName" type="string"/>
        <Field name="jobname" required="true" type="string">
          <Script>
            <Source>
              return identity.getAttribute("jobname");
            </Source>
          </Script>
        </Field>
        <Field name="CallCenterId" type="string" value="04vdy0000002mRxAAI"/>
      </Section>
    </Form>
    <Form name="Create PublicGroups" objectType="PublicGroups" type="Create">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="Create PublicGroups"/>
        </Map>
      </Attributes>
      <Section>
        <Field displayName="con_prov_policy_salesforce_direct_Name" helpKey="Public Group Name." name="Name" required="true" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_DeveloperName" helpKey="It is unique name for the Public Group. This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores." name="DeveloperName" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_DoesIncludeBosses" helpKey="Indicates whether the managers have access (true) or do not have access (false) to records shared with members of the group." name="DoesIncludeBosses" reviewRequired="true" type="boolean" value="true"/>
      </Section>
    </Form>
    <Form name="Update PublicGroups" objectType="PublicGroups" type="Update">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="Update PublicGroups"/>
        </Map>
      </Attributes>
      <Section>
        <Field displayName="con_prov_policy_salesforce_direct_Id" helpKey="Public Group Id." name="Id" reviewRequired="true" type="string">
          <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_Name" helpKey="Public Group Name." name="Name" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_DeveloperName" helpKey="It is unique name for the Public Group.This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores." name="DeveloperName" reviewRequired="true" type="string"/>
        <Field displayName="con_prov_policy_salesforce_direct_OwnerId" helpKey="ID of the user who owns the group." name="OwnerId" reviewRequired="true" type="string">
          <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
        <Field displayName="con_prov_policy_salesforce_direct_DoesIncludeBosses" helpKey="Indicates whether the managers have access (true) or do not have access (false) to records shared with members of the group." name="DoesIncludeBosses" reviewRequired="true" type="boolean"/>
      </Section>
    </Form>
    <Form name="update" objectType="account" type="Update">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="update"/>
        </Map>
      </Attributes>
      <Section name="Section 1">
        <Field name="jobname" type="string">
          <Script>
            <Source>
              return identity.getAttribute("jobname");
            </Source>
          </Script>
        </Field>
      </Section>
    </Form>
    <Form name="Disable Account" objectType="account" type="Disable">
      <Attributes>
        <Map>
          <entry key="pageTitle" value="Disable Account"/>
        </Map>
      </Attributes>
      <Section name="Section 1"/>
    </Form>
  </ProvisioningForms>
  <Schemas>
    <Schema created="1785444105208" displayAttribute="Username" id="0a116bce9fb41232819fb4c2fbf80104" identityAttribute="Id" instanceAttribute="" nativeObjectType="User" objectType="account" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Internal salesforce id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Alias" type="string">
        <Description>User's assigned alias.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="City" type="string">
        <Description>User's city.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="CommunityNickname" type="string">
        <Description>DisplayNames for user's online communities.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="CompanyName" type="string">
        <Description>User's company name.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" name="CallCenterId" type="string">
        <Description>User's call center.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Country" type="string">
        <Description>User's country.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Department" type="string">
        <Description>User's department.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Email" type="string">
        <Description>User's Email address.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Division" type="string">
        <Description>User's division.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="EmployeeNumber" type="string">
        <Description>User's employee number.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Extension" type="string">
        <Description>User's telephone extension.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Street" type="string">
        <Description>The street address associated with the User.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Fax" type="string">
        <Description>User's fax number.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="IsActive" type="boolean">
        <Description>Flag that indicates if the user is active in Salesforce.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="IsFrozen" type="boolean">
        <Description>Flag that indicates if the user is frozen in Salesforce.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Username" type="string">
        <Description>Contains the name that a user enters to log into the API or the user interface.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="FirstName" type="string">
        <Description>User's first name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="LastName" type="string">
        <Description>User's last name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="EmailEncodingKey" type="string">
        <Description>Encoding that should be used during email communications.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>User's fullname.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserPermissionsMarketingUser" type="boolean">
        <Description>Maps to the Marketing User Flag.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserPermissionsOfflineUser" type="boolean">
        <Description>Maps to the Offline user Flag.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserPermissionsSFContentUser" type="boolean">
        <Description>Maps to Sales Anywhere User.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Phone" type="string">
        <Description>User's phone number.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" name="ProfileId" schemaObjectType="group" type="string">
        <Description>ID of the profile assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ProfileName" type="string">
        <Description>Name of the profile assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="PublicGroups" schemaObjectType="PublicGroups" type="string">
        <Description>Public groups are the entitlements for user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="QueueNames" type="string">
        <Description>Queues assigned to the user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ReceivesAdminInfoEmails" type="string">
        <Description>Receive the salesforce.com administrator newsletter.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" name="Role" schemaObjectType="Role" type="string">
        <Description>The Role assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserType" type="string">
        <Description>This is user type of salesforce user i.e Standard, Partner, AutomatedProcess.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="State" type="string">
        <Description>User's state.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Title" type="string">
        <Description>User's title.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ReceivesInfoEmails" type="string">
        <Description>Receive the salesforce.com newsletter.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" multi="true" name="PermissionSet" schemaObjectType="PermissionSet" type="string">
        <Description>PermissionSet assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" managed="true" multi="true" name="PermissionSetGroup" schemaObjectType="PermissionSetGroup" type="string">
        <Description>PermissionSetGroup assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="PermissionSetLicense" schemaObjectType="PermissionSetLicense" type="string">
        <Description>PermissionSetLicense assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="ManagedPackage" schemaObjectType="ManagedPackage" type="string">
        <Description>Managed Package assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition multi="true" name="CollaborationGroup" schemaObjectType="CollaborationGroup" type="string">
        <Description>Collaboration Group Id assigned to a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserLicense" remediationModificationType="None" type="string">
        <Description>User's license.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="LanguageLocaleKey" type="string">
        <Description>The user's language.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="LocaleSidKey" type="string">
        <Description>This is the user's locale.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="TimeZoneSidKey" type="string">
        <Description>The timezone of the user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="FederationIdentifier" type="string">
        <Description>A Federation IDs is an identifier that is unique within a salesforce Organization.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="ManagerId" type="string">
        <Description>User's manager id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="jobname" type="string">
        <Description>Workday Job Code</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105208" descriptionAttribute="" displayAttribute="Name" id="0a116bce9fb41232819fb4c2fbf8010b" identityAttribute="Id" instanceAttribute="" nativeObjectType="Role" objectType="Role" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Role Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Role name.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105208" descriptionAttribute="" displayAttribute="NamespacePrefix" id="0a116bce9fb41232819fb4c2fbf8010c" identityAttribute="Id" instanceAttribute="" nativeObjectType="ManagedPackage" objectType="ManagedPackage" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Managed Package Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="NamespacePrefix" type="string">
        <Description>Managed Package NamespacePrefix.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105208" descriptionAttribute="" displayAttribute="Name" featuresString="PROVISIONING" id="0a116bce9fb41232819fb4c2fbf80107" identityAttribute="Id" instanceAttribute="" nativeObjectType="PublicGroups" objectType="PublicGroups" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Public Group Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Public Group Name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="DeveloperName" type="string">
        <Description>It is unique name for the Public Group</Description>
      </AttributeDefinition>
      <AttributeDefinition name="DoesIncludeBosses" type="boolean">
        <Description>Indicates whether the managers have access (true) or do not have access (false) to records shared with members of the group</Description>
      </AttributeDefinition>
      <AttributeDefinition name="OwnerId" type="string">
        <Description>ID of the user who owns the group.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105208" descriptionAttribute="Description" displayAttribute="Name" id="0a116bce9fb41232819fb4c2fbf80106" identityAttribute="Id" instanceAttribute="" nativeObjectType="CollaborationGroup" objectType="CollaborationGroup" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>Collaboration Group Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Collaboration Group Name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="CollaborationType" type="string">
        <Description>Collaboration Group Type.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105208" descriptionAttribute="Description" displayAttribute="Label" id="0a116bce9fb41232819fb4c2fbf80108" identityAttribute="Name" instanceAttribute="" nativeObjectType="PermissionSet" objectType="PermissionSet" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Name" type="string">
        <Description>The internal id for this group.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Label" type="string">
        <Description>The friendly name assigned to the profile.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description>Description for the profiles.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105208" descriptionAttribute="" displayAttribute="MasterLabel" id="0a116bce9fb41232819fb4c2fbf8010a" identityAttribute="Id" instanceAttribute="" nativeObjectType="PermissionSetLicense" objectType="PermissionSetLicense" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>PermissionSetLicense Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="MasterLabel" type="string">
        <Description>PermissionSetLicense MasterLabel.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema aggregationType="group" created="1785444105207" descriptionAttribute="Description" displayAttribute="MasterLabel" id="0a116bce9fb41232819fb4c2fbf70103" identityAttribute="Id" instanceAttribute="" nativeObjectType="PermissionSetGroup" objectType="PermissionSetGroup" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>PermissionSetGroup Id.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="MasterLabel" type="string">
        <Description>PermissionSetGroup Name.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description>PermissionSetGroup Description.</Description>
      </AttributeDefinition>
    </Schema>
    <Schema created="1785444105208" descriptionAttribute="Description" displayAttribute="Name" id="0a116bce9fb41232819fb4c2fbf80105" identityAttribute="Id" includePermissions="true" instanceAttribute="" nativeObjectType="Profile" objectType="group" permissionsRemediationModificationType="None">
      <AttributeDefinition name="Id" type="string">
        <Description>The internal id for this group.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>The friendly name assigned to the profile.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Description" type="string">
        <Description>Description for the profiles.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserType" type="string">
        <Description>This is the type of profile even though the attribute name would indicate a user.</Description>
      </AttributeDefinition>
      <AttributeDefinition name="UserLicense" remediationModificationType="None" type="string">
        <Description>User's license.</Description>
      </AttributeDefinition>
    </Schema>
  </Schemas>
  <ApplicationScorecard created="1785444105208" id="0a116bce9fb41232819fb4c2fbf80109"/>
</Application>

On a side note, regarding the URL, I have these connection values for TEST Salesforce (which is WORKING):

](https://test.salesforce.com/services/oauth2/token"/> "https://test.salesforce.com/services/oauth2/token"/>")

](https://login.salesforce.com/services/Soap/u/"/> "https://login.salesforce.com/services/soap/u/“/>”)

And these for Prod (which is NOT working, although Salesforce says they can see successful authentication):

](https://countryfinancial.my.salesforce.com/services/oauth2/token"/> "https://countryfinancial.my.salesforce.com/services/oauth2/token"/>")

](https://login.salesforce.com/services/Soap/u/"/> "https://login.salesforce.com/services/soap/u/“/>”)

Also, it should be noted that I am deploying this XML via a CI/CD pipeline, so my working XML for TEST is the exact same as what I’m using Prod, just that the URL values are different.

Topic		Replies	Views
Salesforce Connector: Cannot create a portal user without contact IIQ Discussion and Questions identityiq , provisioning	6	162	October 20, 2025
Salesforce connection aggregation error ISC Discussion and Questions aggregation , identity-security-cloud , provisioning	4	283	February 6, 2025
Salesforce connector aggregation error, IIQ Discussion and Questions aggregation , identityiq	5	179	October 16, 2024
SailPoint IIQ -Salesforce aggreagtion failing with error [ ConnectorException ] [ Error details ] java.net.SocketException: Connection resetconnector.sdk.webservices.exception.WebServicesSdkException: java.net.SocketException: Connection reset IIQ Discussion and Questions identityiq , my-sailpoint , developer-days-2023-iiq , developer-days-2024-iiq	2	117	August 14, 2025
Snowflake-IIQ Integration \| Error during Group Aggregation \| The request payload is invalid or malformed. [ Error details ] 391917: Invalid IIQ Discussion and Questions aggregation , identityiq , connectors , tasks , applications	2	121	December 5, 2024

Error when aggregating Salesforce

Which IIQ version are you inquiring about?

Share all details about your problem, including any error messages you may have received.

Related topics