IQService Error - Access Denied (0x80070005) While Modifying AD Group Membership

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

IdentityIQ 8.3

Hi everyone,

I’m facing an issue where the IQService throws an access denied error when trying to modify AD group membership.

Error from SailPoint UI:

Error(s) reported back from the IQService - Error occurred while setting group membership

Access is denied. - HRESULT: [0x80070005]

As per my understanding, this might be due to missing “Write Members” permission on the AD group or its OU. However, the AD team mentioned they already gave “Read and Write” permissions to the IQService account.

Can someone please confirm:

  • Is general Read/Write permission not enough for group membership updates?
  • Should we request explicit Write access to the member attribute?

Thanks in advance!

2

@Arunodai1221, there can be two service accounts in play:

  • the account the service runs as, configured in Windows
  • the account configured in the connector as the IQServiceUser

Check to see what you have configured.

3

Hi, my thoughts here are.

  • May be the service account is not allowed to manage objects in a particular OU. Can you check if you are able to provision access to a group which is in a different OU
  • Login as the service account user to IQ service and validate if you are able to add the users to groups. That way you can narrow down it is not a problem with ISC.
  • Give all the permissions mentioned in the doc for provisioning instead of just giving Write Members and validate if you are able to provision group to the users
    image
    image778×415 10.8 KB