GSMA Account Buffer Issue

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Folks,

Need help setting up GMSA account for AD connector here.

  • Followed DOCO and ran every command Sailpoint suggested
  • Getting below error during test connection:-

    • Error Received:

      Detected password less authentication, but failed to retrieve passwords with error: Exception occurred while executing the RPCRequest: Errors returned from IQService. Buffer cannot be null. Parameter name: buffer

  • Account setup already:

image
image400Ă—340 6.86 KB

  • IQ Server settings still pointed to IQ service account:

  • On IIQ server, GMSA account setup to run the services.

Please suggest anything missing here?

2

Hey Maninder, this looks more like a IQService is not able to retrieve the gMSA password at runtime.

Could you plz try checking the AD Domain Settings, keep the gMSA UPN in the user field, leave password blank, use Strong/SASL, enable passwordless auth, and use port 389 with SSL off?

Also IQService is running as the gMSA on your server, could you plz also verify that both the gMSA itself and the IQService server’s computer account (SERVERNAME$) are allowed to retrieve the gMSA password through PrincipalsAllowedToRetrieveManagedPassword ?

After that, restart IQService and test again.

3

Thanks Harish for the response. I followed the same but still getting same buffer error, below is the entry for that field. The group mentioned has IIQ server in it so have access to it.

image
image781Ă—164 9.79 KB

4

To add, I have two IIQ server (gmsa setup on both), on one server I got this error but when I switched to the other one I got this error: “message”: “returnMap {result=error, message={ExceptionType=sailpoint.connector.ConnectorException, LocalizedMessage=Detected password less authentication, but failed to retrieve passwords with error: Connection reset}}”,

5

@msingh39 Confirm gMSA installation on both servers
Run:

powershell
Test-ADServiceAccount gmsa_sailpoint$
Must return True.

If not, run:

powershell
Install-ADServiceAccount gmsa_sailpoint$

  1. Verify PrincipalsAllowedToRetrieveManagedPassword
    Run:

powershell
Get-ADServiceAccount gmsa_sailpoint$ -Properties PrincipalsAllowedToRetrieveManagedPassword
Ensure both IIQ servers (their computer accounts or group) are listed.

If missing, add:

powershell
Set-ADServiceAccount gmsa_sailpoint$ -PrincipalsAllowedToRetrieveManagedPassword “Domain\IQServiceServers”
3. Validate KDS Root Key replication
Run on multiple DCs:

powershell
Get-KdsRootKey
GUID must be identical across all DCs.

  1. Fix for “Buffer cannot be null” (Server A)
    This means the DC returned an empty password blob.

Actions:

Confirm server is listed in PrincipalsAllowedToRetrieveManagedPassword.

Confirm gMSA is installed locally.

Confirm KDS root key replicated.

Restart IQService service after fixes.

  1. Fix for “Connection reset” (Server B)
    This means RPC channel broke mid‑stream.

Actions:

Validate firewall ports: Kerberos (88), LDAP (389), RPC (135), Netlogon (445), LDAPS (636).

Run:

powershell

Restart IQService service.

Re‑test in SailPoint
Go to Domain Settings.

Use gMSA as Service Account → ON.

Authentication Type → Strong (SASL/Kerberos).

TLS → Disabled.

Account → gmsa_sailpoint@domain.com.

Run Test Connection again.

6

Likely cause :
Case 1: Buffer cannot be null
Meaning: IQService reached the DC, but the gMSA password blob returned was empty.

Root causes:

PrincipalsAllowedToRetrieveManagedPassword does not include the IIQ server’s computer account.

gMSA not properly installed on that server (Install-ADServiceAccount).

KDS root key not replicated to all DCs, so some DCs return null.

Replication lag between root and child domains.

Case 2: Connection reset
Meaning: RPC channel broke while IQService was retrieving the gMSA password.

Root causes:

Firewall or network ports blocked (Kerberos 88, LDAP 389, RPC 135, Netlogon 445, LDAPS 636).

DC locator returning a DC that is unreachable or misconfigured.

TLS mismatch if strong SASL + TLS is enabled but the contacted DC doesn’t support secure LDAP.

Kerberos ticket expiration or mismatch in service context.

7

Thanks for the details. Everything checked and looks good but still getting the error.

Found some points if need to add it in? Anyway tried but still failing.

Navigate to registry and search for SailPoint registry hive.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\IQService-InstanceName
Right-click on the Instance and select permission.

8

Along with the IQ server, The account used to run the IQ service should have the PrincipalsAllowedToRetrieveManagedPassword

Can you confirm if this is in place. Thank you

REf this line : Set-ADServiceAccount -Identity myMSAAccount$ -PrincipalsAllowedToRetrieveManagedPassword IQserviceuser1

The gMSA service account can also be used as the IQService LogOn User (Windows Service LogOn User). In this case, ensure that the gMSA service account has full access to the IQService Instance folder on the registry.

The gMSA account itself and the IQService server computer account are granted permission to retrieve the gMSA password, eliminating the need to set permissions for the IQService LogOn User.

9

Yes Naveen. There is a group created which has IQ server and the account listed under that parameter. One thing I observed that UPN value is missing on that gmsa account so working on that to get that added and will try next.

All prereq’s are there already with permission so wondering where the issue is coming from :frowning:

10

I think I am guessing where the issue is as it seems something related to server certificate. I have initiated new cert and upload in server and updated the same for IQservice. But somehow its still giving me same error with old dns name which I cant find anywhere else on server or VA side.

Received header length as - Error in parsing - input string was not in a correct format