> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/shipped-connectors.md).

# Shipped connectors

The connector definitions that ship, the queue each one names, and the per-connector symptoms that mean you are on the wrong connector rather than the wrong mapping.

## What this is, and when you need it

Thirty-four connector definitions ship with OpenIAM, listed here by the runtime that serves them with the `CONNECTOR_QUEUE` each one names, followed by the connector-specific failures worth recognising on sight. How a definition, a package and a managed system relate is on [Connectors and managed systems](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Connector families

**PowerShell / .NET family** — one Windows runtime, several definitions sharing the `RemoteConnector` metadata type:

| `CONNECTOR_ID`                   | Name                          | `CONNECTOR_QUEUE`   |
| -------------------------------- | ----------------------------- | ------------------- |
| `powershell_ad_rem_connector_id` | AD Win02 Remote               | *(none seeded)*     |
| `O365_CONNECTOR`                 | Azure PowerShell connector    | `RemoteConnector_2` |
| `NEW_EXCHANGE_PS_CON`            | Exchange PowerShell Connector | `RemoteConnector_3` |
| `NEW_WIN_L_PS_CON`               | WinLocal PowerShell Connector | `RemoteConnector_4` |
| `NEW_GENERIC_PS_CON`             | Generic PowerShell Connector  | `RemoteConnector_5` |
| `NEW_MSSQL_PS_CON`               | MSSQL PowerShell Connector    | `RemoteConnector_6` |

**Directory and OS:**

| `CONNECTOR_ID`       | Name               | Queue             |
| -------------------- | ------------------ | ----------------- |
| `51`                 | LDAP CONNECTOR     | *(none seeded)*   |
| `IPA_PC`             | IPA Connector      | `IPA_Connector_1` |
| `63`                 | Linux CONNECTOR    | *(none seeded)*   |
| `MS_GRAPH_CONNECTOR` | MS Graph Connector | `GRAPH_CONNECTOR` |

**Database:**

| `CONNECTOR_ID`         | Name                 | Queue                   |
| ---------------------- | -------------------- | ----------------------- |
| `JDBC_PC`              | JDBC Connector       | `JDBC_Connector_1`      |
| `POSTGRESQL_PC`        | PostgreSQL Connector | `PostgreSQL_1`          |
| `65`                   | Oracle CONNECTOR     | *(none seeded)*         |
| `TEST_H2_DB_CONNECTOR` | Test H2 db Connector | `TestDb_Connector_0001` |

**Enterprise applications:**

| `CONNECTOR_ID`          | Name                   | Queue                     |
| ----------------------- | ---------------------- | ------------------------- |
| `200`                   | SAP CONNECTOR          | `SAP_Connector_1`         |
| `201`                   | Oracle\_EBS CONNECTOR  | `Oracle_EBS_Connector_1`  |
| `SALESFORCE_CONNECTOR`  | Salesforce CONNECTOR   | `SALESFORCE_Connector_1`  |
| `BOX_PC`                | BOX Connector          | `BOX_Connector_1`         |
| `TABLEAU_CONNECTOR`     | TABLEAU CONNECTOR      | `TABLEAU_Connector_1`     |
| `LASTPASS_PC`           | LastPass Connector     | `LASTPASS_Connector_1`    |
| `BOOMI_PC`              | BOOMI Connector        | `BOOMI_Connector_1`       |
| `54`                    | Google Apps CONNECTOR  | *(none seeded)*           |
| `AWS_CONNECTOR`         | AWS CONNECTOR          | `AWS_Connector_1`         |
| `ORACLE_IDCS_CONNECTOR` | ORACLE\_IDCS CONNECTOR | `ORACLE_IDCS_Connector_1` |
| `THALES_CONNECTOR`      | Thales Connector       | `THALES_Connector_1`      |
| `THALES_WSDL_CONNECTOR` | Thales WSDL Connector  | `THALES_WSDL_Connector_1` |
| `REXX_PC`               | Rexx Connector         | `REXX_Connector_1`        |
| `SCIM_CONNECTOR`        | SCIM CONNECTOR         | `SCIM_Connector_1`        |

**HR / authoritative sources:**

| `CONNECTOR_ID`             | Name                     | Queue                                   |
| -------------------------- | ------------------------ | --------------------------------------- |
| `WORKDAY_CONNECTOR`        | Workday CONNECTOR        | `8a80819f6a45db87016a4fec1b2a000a_6257` |
| `SUCCESSFACTORS_CONNECTOR` | Successfactors Connector | `Successfactors_0001`                   |
| `ADP_CONNECTOR`            | ADP CONNECTOR            | `ADP_Connector_1`                       |
| `KRONOS_PC`                | Kronos Connector         | `Kronos_Connector_1`                    |

**Ticketing** (2026.10.2):

| `CONNECTOR_ID` | Name             | Queue                |
| -------------- | ---------------- | -------------------- |
| `TICKET_PC`    | Ticket Connector | `TICKET_Connector_1` |

The Ticket Connector raises tickets in Jira or ServiceNow instead of provisioning accounts; its managed systems choose the system in **Ticketing system**. See [Ticket integration with Jira and ServiceNow](/administration-guide/ticketing.md).

**Legacy, pre-queue:** `61` AppTableConnector and `62` Groovy Script CONNECTOR predate the queue model — they carry `SERVICE_URL`/`CONNECTOR_INTERFACE` values from the 3.x SOAP era and no `CONNECTOR_QUEUE`. Treat them as historical unless your release notes say otherwise.

{% hint style="warning" %}
`WORKDAY_CONNECTOR`'s shipped `CONNECTOR_QUEUE` is the literal `8a80819f6a45db87016a4fec1b2a000a_6257` — an auto-generated ID that leaked into the seeded data in 4.2.0.3 and is still there. Left as shipped, OpenIAM sends Workday requests to `8a80819f6a45db87016a4fec1b2a000a_6257_Request`, a queue nothing consumes. Read the queue name off the connector definition and change it to a name your connector deployment actually consumes before you use it.
{% endhint %}

The corresponding provisioning Groovy scripts ship under `provision/`, one directory per family: `ad` (33 per-attribute scripts, plus `group`, `fileshare` and a 32-script `powershell` variant), `aws`, `azure`, `box`, `exchange`, `google`, `ipa`, `jdbc`, `ldap`, `linux`, `membership`, `o365`, `oracle`, `oracle-ebs`, `oracle-idcs`, `postgresql`, `primary`, `rexx`, `salesforce`, `sap`, `scim`, `successfactors`, `tableau`, `test-h2`, `thales`, `thales-wsdl`. Synchronization scripts mirror the same list under `sync/{user,group,role,org,resource,mansys}/`. Full inventory: [Shipped Groovy scripts](/administration-guide/reference/shipped-groovy-scripts.md).

## Symptoms that point at the wrong connector, not the wrong mapping

The reflex when a provisioning operation fails is to reopen the policy map. For the three symptoms below that is wasted effort: each one says the managed system is being talked to by the wrong connector, or by the right connector pointed at the wrong endpoint, and no amount of attribute mapping will change the outcome.

| Verbatim symptom                                                                                                                                                         | What it actually means                                                                                                                                                                                                                                                                                                                    | What to change                                                                                                                                                                                                                                                                                                                                               |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `javax.naming.PartialResultException: [LDAP: error code 10]` in the connector log, surfacing in the Webconsole as `Crud Operation Error: java.lang.NullPointerException` | LDAP result code 10 is **Referral**. Active Directory answered "not here, try over there" for a search that crossed a domain or naming-context boundary, the connector did not follow the referral, and the empty result became a null further up                                                                                         | Set the object's **Base DN** and **Search Base DN** to a container inside the domain the connector is bound to, and narrow **Search Scope**. Chasing the referral itself is the wrong fix — see [Worked configuration 1: LDAP or Active Directory](/administration-guide/reference/managed-system-fields.md#worked-configuration-1-ldap-or-active-directory) |
| `redirect_uri_mismatch` from a Salesforce operation                                                                                                                      | Salesforce's own OAuth error, relayed through the connector. The **Host URL** on the managed system is not the org Salesforce issued the connected app for, and/or **Grant Type** does not match what a server-to-server integration may use                                                                                              | Correct `HOST_URL` to the org's login or My Domain URL, and set **Grant Type** to `password` rather than `authorization_code`                                                                                                                                                                                                                                |
| `SYNCHRONIZATION_EXCEPTION`, with `can't retrieve lineObjects from target system.` in the same audit event                                                               | The synchronization asked the connector for the source records and the connector could not produce them. On the Azure path this is almost always the **AzureADGraph** package installed on a queue where the **MicrosoftPsGraph** package was required — the shipped query is a `Microsoft.Graph` cmdlet the AzureAD module does not have | Install the `MicrosoftPsGraph` connector package on the `GRAPH_CONNECTOR` queue, or point the managed system at the connector definition that matches the package you actually installed                                                                                                                                                                     |

### `[LDAP: error code 10]` is a referral, not a mapping fault

LDAP result code 10 is `referral` in RFC 4511, and Active Directory emits it routinely: a search whose base DN sits above a domain boundary, or that names an object in another naming context, gets a referral rather than an error. `javax.naming.PartialResultException` is the JNDI wrapper for "the server sent a referral and this context is not configured to follow it".

{% hint style="info" %}
**Both strings come from the LDAP connector, not from OpenIAM.** Neither `PartialResultException` nor `Crud Operation Error` is an OpenIAM message, so the exact wording you see may differ by connector version — treat the wording above as a recognition aid, taken from a field report, not as a string to match on. **This has not been verified against a running deployment for every connector version.** What is certain is where the search boundary is set: `MNG_SYS_OBJECT_MATCH.BASE_DN`, `SEARCH_BASE_DN` and `SEARCH_FILTER` per object type, plus `MANAGED_SYS.SEARCH_SCOPE` — the fields catalogued in [Managed system fields](/administration-guide/reference/managed-system-fields.md#connector-specific-dynamic-fields).
{% endhint %}

Read the connector log for the referral before you read the Webconsole message: the Webconsole message names the *consequence*, the connector log names the *cause*. A heartbeat of `status = "Ok"` proves only that the bind worked, which is exactly why a base-DN fault survives a green connection test.

### `redirect_uri_mismatch` on Salesforce

The string is Salesforce's own, relayed through the connector: the connected app rejected the token request. Two managed-system fields cause it.

`SALESFORCE_MANAGED_SYS` ships with an **empty** `HOST_URL`, so every deployment has to supply it — and a value that merely *authenticates* is not necessarily the org the connected app belongs to. The second is **Grant Type**, a free-text field on the Salesforce page template whose shipped default is the empty string: nothing validates what you type and nothing suggests the value. For a server-to-server integration the value is `password`, not `authorization_code` — an authorization code flow needs a browser redirect a connector has no way to perform, which is precisely why Salesforce answers `redirect_uri_mismatch`.

{% hint style="warning" %}
**The field's English label is misspelled in the shipped seed.** The `METADATA_ELEMENT.ATTRIBUTE_NAME` is `Grant Type`, but the `LANGUAGE_MAPPING` row that the Webconsole actually renders carries the text `Grand Type`. Search the managed-system form for **Grand Type** if **Grant Type** finds nothing. The sibling fields on the same template are **API Type** (a `SELECT` of `REST API` / `SOAP API`), **Client ID** and **Client Secret** (both password-typed, so they read back masked) and **API Version**.
{% endhint %}

### `can't retrieve lineObjects from target system.`: the two Azure Graph packages

The string is exact, and the response code beside it does not match it because the two come from different places: when the request for source records fails, OpenIAM records the reason `can't retrieve lineObjects from target system.` followed by the underlying message and logs `QUERY was:` with the configured query, then the outer handler overwrites the response code with `SYNCHRONIZATION_EXCEPTION`. The `QUERY was:` line in the synchronization service log is the fastest thing to read next.

On the Azure path the cause is usually a package mismatch, because OpenIAM ships **two** Azure Graph connectors and they are not interchangeable:

| Definition                 | `CONNECTOR_ID`       | Queue               | Windows package    | PowerShell module it drives                                         |
| -------------------------- | -------------------- | ------------------- | ------------------ | ------------------------------------------------------------------- |
| MS Graph Connector         | `MS_GRAPH_CONNECTOR` | `GRAPH_CONNECTOR`   | `MicrosoftPsGraph` | `Microsoft.Graph` — `Connect-MgGraph`, `Get-MgUser`                 |
| Azure PowerShell connector | `O365_CONNECTOR`     | `RemoteConnector_2` | `AzureADGraph`     | the retired `AzureAD` module — `Connect-AzureAD`, `Get-AzureADUser` |

`MS_GRAPH_CONNECTOR`, its managed system `AZURE_GRAPH_MS` ("Azure AD (MS Graph)") and the sync config `SYNC_AZURE_GRAPH_USER` all ship as of 4.2.1.10, and that sync config's **Query** is the literal `Get-MgUser -UserId [UPN] -Property AssignedLicenses,UserPrincipalName` — a `Microsoft.Graph` cmdlet. Install `AzureADGraph` on the `GRAPH_CONNECTOR` queue and the connector consumes the request, fails to recognise `Get-MgUser`, and the synchronization reports exactly the pair of strings above — with a **green heartbeat**, because the bind itself succeeded. Read the **Query** on the sync configuration and compare its cmdlet prefix (`-Mg` versus `-AzureAD`) against the package your Windows host actually has installed; ask whoever installed it if you cannot see the host.

The same migration also renames the older objects to say so: `O365_MANAGED_SYS` becomes `O365 Managed System (Deprecated)`, and `AZURE_USER_SYNC` and `AZURE_GRP_SYNC` become `Azure AD User Sync (Deprecated)` and `Azure Group Sync (Deprecated)`, in the same release. If your Azure configuration still references a managed system or sync whose name ends in `(Deprecated)`, you are on the `AzureAD`-module path whether you meant to be or not.

## Related

* [Connectors and managed systems](/administration-guide/lifecycle/connectors-and-managed-systems.md) — package, definition and managed system, and how to tell a runtime fault from a configuration fault.
* [Managed system fields and the connector request](/administration-guide/reference/managed-system-fields.md) — what each connector-specific field writes.
* [Verify connectivity to the target](/administration-guide/lifecycle/verify-connection.md) — the diagnostic sequence these symptoms feed.
* [Shipped Groovy scripts](/administration-guide/reference/shipped-groovy-scripts.md) — the per-family provisioning and synchronization script inventory.

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/reference/shipped-connectors.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.