SCIM 2.0 Account and entitlement Aggregation Time Out Error

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi,

We are getting Account and entitlement aggregation error for SCIM 2.0 .

Account:openconnector.ConnectorException: Read timed out

entitlement : Exception during aggregation of Object Type group on Application CyberArk [source]. Reason: java.lang.RuntimeException: An error occurred while aggregating Application CyberArk [source] openconnector.ConnectorException: Read timed out

Thanks for your help

2

I would test the various SCIM API endpoints on your CyberArk tenant through Postman (using the same credentials you’re using from ISC) and ensure you get responses first

GET /scim/v2/users
GET /scim/v2/groups
GET /scim/v2/containers
GET /scim/v2/containerpermissions

What I found is that I could not use these SCIM endpoints without purchasing the Privilege Lifecycle Manager add-on entitlement (PRIV-LCM-ADDON) from CyberArk

1 Like
3

@saikumarS just following up to see if you were able to try any of these troubleshooting steps

4

Hy Mark,

Thank you very much for the steps .

We are checking the endpoints , I will let you know the update…

Thanks.

5

Have you tried extending the timeout, we had a similar issue reading Delinea via SCIM.

Try via api setting the following /connectorAttributes/aggregateTimeout to a higher value, using 10 second increments and test.

6

Hi @anthany,

How much we can put as higher value ? Currently we have “aggregateTimeout”: 495 Sec

image

Thanks.

7

Hi @saikumarS
We had success with a value of 650 but did take it up to 2000

8

I tried till 2000 and no luck :frowning:

9

I have the following which is working:

ProvisioningTimeout:600
Custom timeout:650
AggregateTimeout:2000

These were all applied via API

It’s worth noting that before these values we were aggregating data but we were only getting the data until the original timeout value.

Are you aggregating any data at all?

10

No , 0 Accounts scanned.

Custom timeout is nothing but connection timeout ?

12

Was this tried? Seems a good idea to ensure the API calls work outside of ISC before going into further troubleshooting steps with ISC

13

Hy Mark ,

yeah , I really wanted to try this once my CyberArk team is available .

I will let you know, Once i tested.

Thankss.

14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.