> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/4-troubleshootingconnector.md). # Provisioning operations troubleshooting This section describes how to troubleshoot bugs and explains known issues of provisioning operations Two failures on this page share one cause: **the connector has become unbound from RabbitMQ** and is no longer receiving requests. OpenIAM is aware of it and a permanent fix is in progress; until then, re-saving the connector rebinds it. ## An identity stays in PENDING\_CREATE or PENDING\_UPDATE | Symptom | Cause | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | A user's identity keeps the status `PENDING_CREATE` or `PENDING_UPDATE` long after provisioning, even though the connector has already created or updated the account | The connector is unbound from RabbitMQ and no longer receives requests | {% stepper %} {% step %} **Re-save the connector.** In **Webconsole → Provisioning → Connectors**, open the connector that is failing and click **Save** without changing anything. Saving is what rebinds it. {% endstep %} {% step %} **Confirm the replies are arriving.** Open the managed system dashboard and click the **connector replies** icon on that managed system's row. {% endstep %} {% step %} **Or check the audit log.** Responses appear at the top of the search results as one of: * `SAVE_CONNECTOR_RESPONSE` * `SAVE_GROUP_CONNECTOR_RESPONSE` * `SEARCH_CONNECTOR_RESPONSE` * `ENABLE_CONNECTOR_RESPONSE` * `DISABLE_CONNECTOR_RESPONSE` * `DELETE_CONNECTOR_RESPONSE` * `RESET_PASSWORD_CONNECTOR_RESPONSE` {% endstep %} {% endstepper %} ## Sync through a connector returns nothing | Symptom | Possible causes | | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The audit events `PROVISIONING_USER_SEARCH` and `PROVISIONING_GROUP_SEARCH` carry the error **Response is not received from RabbitMQ during reply timeout** | The connector is unbound from RabbitMQ; the wrong synchronization source is selected; or the query returned more rows than the connector could process inside the reply timeout | {% stepper %} {% step %} **Re-save the connector.** As above — **Webconsole → Provisioning → Connectors**, open the connector, click **Save**. Then check the managed system dashboard's connector replies icon. {% endstep %} {% step %} **Set Synchronization Source to Connector — Asynchronous and Multi-Threaded.** The older plain **Connector** source is deprecated and does not return results this way. {% endstep %} {% step %} **Raise the reply timeout.** A query returning many rows can take longer than the 30-second default, and the reply is discarded before the connector finishes. Extend the timeout on **the IDM and synchronization services**, then restart them and run the sync again. Add the option to `start.sh` in `/usr/local/openiam/services` — the script each OpenIAM service unit runs, with the service name as its first argument: {% code overflow="wrap" %} ``` $JAVA_HOME/bin/java -Dlogging.level.root=INFO -Dlogging.level.org.openiam=WARN -Dorg.openiam.mq.broker.reply.timeout=3000000 -Dconfpath=$HOME_DIR -jar $JAVA_OPTS $HOME_DIR/services/bin/$1.jar > $HOME_DIR/logs/$1.log ``` {% endcode %} The value is in milliseconds — `3000000` is 50 minutes. {% endstep %} {% endstepper %} ## Connector error codes When a connector operation fails, the response carries one of the shared `ConnectorErrorCode` values below (visible in the audit log's connector-response entry and in the connector's own log). Use this table to map the code to its likely cause. **Configuration and connectivity**
CodeMeaning
INVALID_CONFIGURATIONThe managed-system configuration is incomplete or wrong (missing attribute, bad path, etc.).
UNABLE_TO_CONNECTThe connector could not reach the target system — check URL, network, and credentials.
TEST_CONNECTION_ERRORThe test-connection operation failed.
CERTIFICATE_INSTALLATIONA TLS certificate could not be installed/trusted.
JDBC_DRIVER_NOT_FOUNDThe JDBC driver class could not be loaded — wrong class name or driver JAR missing from the connector classpath.
SCIM_CLIENT_NOT_INITIALIZEDThe SCIM client failed to initialize before the operation.
NO_FILEA required file (for example, a configuration file) was not found.
**Request problems**
CodeMeaning
EMPTY_REQUEST / NULL_OPERATION / NULL_OBJECT_TYPEThe incoming request is malformed — missing body, operation, or object type.
OBJECT_TYPE_NOT_SUPPORTED / OPERATION_NOT_SUPPORTEDThe connector does not support the requested object type or operation (see the connector page's supported-operations table).
INIT_REQUEST_CLASS_ERROR / REQUEST_INSTANTIATE_ERRORThe request message could not be deserialized into the expected class — typically a version mismatch between OpenIAM and the connector.
INVALID_SEARCH_QUERYThe search/sync query is invalid for this connector.
SEARCH_BASE_DN_NOT_DEFINED(LDAP) No search base DN configured.
NO_SUCH_IDENTIFIERThe referenced object/identity was not found on the target.
**Operation failures**
CodeMeaning
CRUD_OPERATION_ERROR / SAVE_OPERATION_ERRORA create/update/delete operation failed on the target — the error text carries the underlying cause.
ERROR_ON_CREATE_USER / ERROR_ON_UPDATE_USER / ERROR_ON_DELETE_USER / ERROR_ON_SELECT_USERThe specific user operation failed.
ERROR_ON_SUSPEND_USER / ERROR_ON_RESUME_USER / ERROR_ON_LOCK_USERThe status-change operation failed.
ERROR_ON_RESET_PASSWORD / NOT_VALID_PASSWORDPassword reset failed / the password violates the target's rules.
SEARCH_USER_FAILED / SEARCH_GROUP_FAILED / NO_RESULTS_RETURNEDA search returned an error or nothing.
SQL_ERROR(Database connectors) The SQL statement failed — check the query and the service account's privileges.
DIRECTORY_ERROR(Directory connectors) An LDAP/directory operation error.
OTHER_ERRORAny unclassified failure — check the connector log for the stack trace.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/connector-configuration/4-troubleshootingconnector.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.