Issue with privileged task automation workflow

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi all,

I am trying to set up privileged task workflow and testing out using the get user by samaccountname AD task. I am getting the following error when I test it.
{“error”:{“detailCode”:“403 Authorization Failed”,“message”:{“locale”:“en-US”,“localeOrigin”:“DEFAULT”,“text”:“Login failed for the supplied user account. Invalid username or password for the supplied domain.”}}}
I can confirm that the username and password are accurate. I am also able to run an ldap search from PAG and I am getting results. I couldn’t find any additional details in PAG logs even after turning on debug level.
Anyone else faced this issue? Are there any additional configurations to enable more logging in PAG?

Thanks in advance!

2

Resurfacing this post to see if anyone got the privileged task automation workflow to work using a Delinea Secret Server cloud credential store? I don’t think there’s an issue with the secret path or credential store configuration as I am able to use the same path in Source configuration which works without issue. Its the privileged task workflow that is having issue. Couldn’t get much from logs. Support too doesn’t seem to know much about this feature.

Thanks,
Sreejith

3

Tagging @sailpoint_employees to see if I can get any help?

4

having the same issue

5

@svenkitachalam - not sure if you’re still having the issue, i solved this by using the abc.com for the FQDN instead of the DC=abc,DC=com

6

Hi @yufeifu12345678 - I have it as abc.com, but still get a 403 error.

7

for your username and password, are you storing the domain info at Delinea level or using the suffix/prefix path?

8

I am using domain info in Delinea. I am using the same secret path in the credential store configuration of an AD source which works fine. It fails only in Privileged task automation action. Unfortunately, nothing in logs that is helping me solve this and support has no clue about this feature.

9

@svenkitachalam

Hi ,

How are you enabling debug level for pag logs. our workflow is getting struck at one of the pag step and we dont see any thing in pag logs and workflow is also not getting executed. its just struck at the pag step. can any one help.

10

I am having a similar issue. I am seeing an error for calling https://connect.identitynow.com/commands?limit=10&commandSetId=pag.

In the logs there is a bit of a stack trace. Calling this URL w/ curl gives a 403. I would like to debug/turn up logging, but it doesn’t seem to work so far.

11

I read somewhere it only works with cyberark (got to dig up where I saw that). I tried it with Azure Vault way back. Url works well and brings out the id and password info in json format but ISC ignored it. Wonder if anyone has got it working without cyberark

12

My issue was with the credential provider url syntax. (we are using delinea as the cred provider)

The error I saw in the log was during the SHUTDOWN of PAG, and not the start up.

Everything is working as it should now. I am still looking for a way to debug. I will try using the GUI to set debug on, and see if that helps and report back.

So, in short it definitely works with Delinea.

I found that you have to use the following syntax: (everything inside the “/”, between the cred_providername and the field you are pulling back needs to be URL, encoded.) SP uses the “/” as a field separator it appears.

secrets://cred_provider_name_from_SP/folder1%2fnextFolder2%2fsecretname/Password

13

That is good to know! I will go an try it again with Azure vault

14

Hi All
Does anyone worked with AWS vault with PTA.
I have azure VA and i am using AWS vault as credential provider.
I am facing some issue. If anyone worked on it. Please let me know
thanks

15

Use this as guideline to properly configure it.

16

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.