IQ Service Error during AD Account Creation/Modification Request

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

During the AD account creation/modification, for some instances we are getting below error. Note that IQ Service runs on TLS Port only. Refer the below screenshot.

image
image560×388 63.5 KB

we are getting the error as .

[“Error(s) reported back from the IQService - Failed to execute native before provisioning script.ScriptExecutor service is not available., One of the possible reasons for internally disabling the ScriptExecutor service is presence of non-TLS port configuration for the IQService”]

Note the After Create Script is getting executed for some instances and for some its not. What could be the issue?

2

Did this run in non-TLS earlier and changed to TLS now? If so, you must remove the non-TLS port from the configuration. Also please refer this article Running Powershell directly via the IQService - Page 7 - Compass check whether it helps you.

3

Nope, the IQ Service Servers where already on TLS Ports only when the deployment happened. So, if you see the screenshot, for primary IQ Service, we only have TLS port configured and for Secondary IQ Service, we have both TLS and Non-TLS configured as per below screenshot. Hence, do you think we have to remove the non-tls port configuration from Secondary instance as well of IQ Service?

image
image560×390 62.8 KB

4

Yes, you must remove the non-TLS port. You can use the below command to remove it.

IQService.exe -p <zero or negative port number>

You can refer more details over here, Recent Updates

5

@rohit_wekhande Did your issue resolve?

6

Nope, its still there. We are working with Infra team and SailPoint.

1 Like
7

Hi Rohit,

Are you able to get any resolution for this?

8

Not yet, work is in progress.

9

We are also struggling with similar issue. Yesterday our IQService got updated automatically and since then we are observing this issue. Any action items or takeaways from your experience that we should follow?

10

Hello Mahesh,

If your earlier IQ Service was older version than May-2025, then, new version of IQ Service which is (May - 2025) will only support the TLS connections. So, you can use this command to remove the NON-TLS port and just operate on the TLS port.

Hence, following are the action.

  1. Enable TLS Port
  2. Use CA signed Certificates for the same.
  3. Once the TLS port is Enabled.
  4. Disable the Non TLS Port.

Below is command for disabling the non TLS Port

IQService.exe -p <zero or negative port number>

In order to enable the TLS, follow the below article.

Enable TLS

We have executed this command which removes the non-TLS port from configurations, the testing from client is in progress.

11

Hi Rohit, issue was resolved? I am dealing with it now.

I disabled non-tls port using -p 0, -p -1 and also deleting the port entry from registry. No matter what I do, iqservice always starts listening on 5050..

12

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.