Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle

[#1]

Article Number

000038029

Applies To

RSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition: 7.0.x, 7.1.x, 7.2.x
 

Issue

This RSA Knowledge Base article is a compilation of all known RSA Knowledge Base articles on issues related to the RSA Identity Governance & Lifecycle AFX Connectors and is meant to be a central resource for troubleshooting such issues. For troubleshooting AFX Server issues, please see RSA Knowledge Base Article 000038030 -- Troubleshooting AFX Server issues in RSA Identity Governance & Lifecycle.

Resolution

 RSA Knowledge Base Articles for debugging AFX Connectors  

• 000033429 -- How to turn on debug logging to troubleshoot AFX connectors in versions 7.0.0, 6.9.1 and 6.8.1 of RSA Identity Governance & Lifecycle
• 000030219 -- How to turn on debug logging to troubleshoot AFX connectors in versions 7.0.1 and higher of RSA Identity Governance & Lifecycle

RSA Knowledge Base Articles for troubleshooting AFX Connectors that remain in a Deployed/Not Deployed state:

There are four valid states for AFX connectors:

1. Running
2. Stopped
3. Deployed
4. Not Deployed

All these states are valid however, the Deployed and Not Deployed states are temporary and if connectors remain in either of those states, there is a problem that needs to be addressed. Below is a list of RSA Knowledge Base Articles meant to assist in trouble-shooting AFX connectors that do not progress from the Deployed/Not Deployed state to a Running state.

Articles on AFX Connectors in a Deployed state

• 000039222 -- AFX Connectors remain in a Deployed state and 'java.lang.SecurityException: Algorithm not allowable in FIPS140 mode: MD5' error in RSA Identity Governance & Lifecycle
• 000038512 -- AFX Connectors remain in a Deployed state and 'Detected missing/corrupt journal files' error in RSA Identity Governance & Lifecycle
• 000038161 -- AFX new or updated Connectors remain in a Deployed state and the MMC application fails to load in RSA Identity Governance & Lifecycle
• 000038123 -- AFX Connectors remain in a Deployed state, mmc-console fails to start and 'Unable to initialize query handler' acccessing the SearchIndex in RSA Identity Governance & Lifecycle
• 000038048 -- AFX Connectors remain in a Deployed state and ActiveMQ is not running in RSA Identity Governance & Lifecycle
• 000034590 -- AFX Connectors cycle between Running, Deployed, Not Deployed and Stopped states in version 6.9.1 of RSA Identity Governance & Lifecycle
• 000030163 -- AFX Connectors remain in a Deployed state and Port 8585 already in use error in RSA Identity Governance & Lifecycle
• 000030159 -- AFX Connectors remain in a Deployed state and 'Failed to get flows for server. No associated server id' error in RSA Identity Governance & Lifecycle
• 000030081 -- AFX Connectors remain in a Deployed state and 'Could not locate data file kahadb/db-XXX.log' error in RSA Identity Governance & Lifecycle

Articles on AFX Connectors in a Not Deployed state

• 000038400 -- Cloning AFX connectors creates duplicate connectors if connector names have been modified in RSA Identity Governance & Lifecycle
• 000038067 -- Running AFX Connectors start to fail, edited connectors remain in a Not Deployed state and 'Could not connect to broker URL: tcp://localhost:61616 (Connection refused)' error in RSA Identity Governance & Lifecycle
• 000037477 -- AFX is unresponsive and one or more AFX Connectors are in a Not Deployed state in RSA Identity Governance & Lifecycle
• 000034590 -- AFX Connectors cycle between Running, Deployed, Not Deployed and Stopped states in version 6.9.1 of RSA Identity Governance & Lifecycle
• 000032419 -- Running AFX Connectors start to fail, edited connectors remain in a Not Deployed state and 'Failed to start inbound endpoint "endpoint.http.localhost.8089.callback"; Address already in use' error in RSA Identity Governance & Lifecycle
• 000029981 -- AFX Connectors remain in a Not Deployed state and templates show (Migration Required) in RSA Identity Governance & Lifecycle

RSA Knowledge Base Articles for troubleshooting non connector-type-specific AFX Connector issues

• 000038998 -- AFX Connectors lose CyberArk Password Vault settings when AFX is restarted in RSA Identity Governance & Lifecycle
• 000038781 -- What is 'AFX fulfillment state V' that is sometimes seen in the AFX log in RSA Identity Governance & Lifecycle?
• 000038780 -- Change Requests stuck in the AFX Fulfillment Handler Workflow Node and Workflows Stalled in RSA Identity Governance & Lifecycle
• 000038729 -- Special characters other than '_' and '$' are not allowed for variables in AFX connector mapping fields in RSA Identity Governance & Lifecycle
• 000038400 -- Cloning AFX connectors creates duplicate connectors if connector names have been modified in RSA Identity Governance & Lifecycle
• 000038399 -- Import of an AFX connector does not show the display name of the connector in RSA Identity Governance & Lifecycle
• 000038067 -- Running AFX Connectors start to fail, edited connectors remain in a Not Deployed state and 'Could not connect to broker URL: tcp://localhost:61616 (Connection refused)' error in RSA Identity Governance & Lifecycle
• 000036907 -- Access Fulfillment Express (AFX) connector export fails with 'Could Not Create Connector Package' and 'duplicate entry' errors in RSA Identity Governance & Lifecycle
• 000036858 -- Access Fulfillment Express (AFX) Connector import fails to import enabled capabilities if no mappings are defined in RSA Identity Governance & Lifecycle 
• 000034590 -- AFX Connectors cycle between Running, Deployed, Not Deployed and Stopped states in version 6.9.1 of RSA Identity Governance & Lifecycle
• 000033951 -- Memory leak when continuously creating Access Fulfillment Express (AFX) Connectors in RSA Identity Governance & Lifecycle
• 000033847 -- Import of the AFX standard connectors fails with 'UT000020: Connection terminated as request was larger than 10485760' in RSA Identity Governance & Lifecycle
• 000033770 -- When AFX is started, some AFX Connectors fail to go to a Running state due to Out of Memory errors in RSA Identity Governance & Lifecycle
• 000033732 -- Import of AFX Connectors fails with 'Connector Install Failure' in RSA Identity Governance & Lifecycle
• 000032419 -- Running AFX Connectors start to fail, edited connectors remain in a Not Deployed state and 'Failed to start inbound endpoint "endpoint.http.localhost.8089.callback"; Address already in use' error in RSA Identity Governance & Lifecycle
• 000031515 -- AFX fulfillment workflow switches to manual fulfillment when using workflow variables in an AFX Connector in RSA Identity Governance & Lifecycle
• 000031365 -- AFX indicates access has been added/removed but the Change Request remains in Pending Verification and the access has not been added/removed from the data source in RSA Identity Governance & Lifecycle
• 000030658 -- AFX test connector settings button times out and the test connector capabilities work or the test connector capabilities fail but the test connector settings button succeeds in RSA Identity Governance & Lifecycle
• 000030656 -- AFX Server and Connector failures if AFX is started as the root user in RSA Identity Governance & Lifecycle
• 000030157 -- How to replace an Access Fulfillment Express (AFX) Connector jar file that has been uploaded to an AFX connector template in RSA Identity Governance & Lifecycle
• 000029903 -- How to adjust the Access Fulfillment Express (AFX) test connector capabilities timeout value in RSA Identity Governance & Lifecycle
• 000029600 -- The Template ({Connector Template Name}) has missing file content error when creating AFX Connectors in RSA Identity Governance & Lifecycle

RSA Knowledge Base Articles for troubleshooting connector-type-specific AFX Connector issues:

• 000039230 -- Generic REST AFX Connector fails with ValidationError in RSA Identity Governance & Lifecycle
• 000039184 -- Generic REST AFX Connector does not encrypt Additional Parameters when defined as Encrypted in RSA Identity Governance & Lifecycle
• 000039044 -- Salesforce AFX Connector 'Update an Account' Capability fails to update additional Parameters in RSA Identity Governance & Lifecycle
• 000039033 -- AFX Connectors remain in a Not Deployed state after patching or upgrading RSA Identity Governance & Lifecycle
• 000038812 -- Salesforce AFX Connector provisioning fails with 'Error occured while generating access token from refresh token' and INVALID_SESSION_ID in RSA Identity Governance & Lifecycle
• 000038728 -- Active Directory AFX Connector Create Account capability fails when skip certificate validation in RSA Identity Governance & Lifecycle
• 000038716 -- 'javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path' error when testing a RESTful Web Service AFX Connector in RSA Identity Governance & Lifecycle
• 000038513 -- How to configure a JSON response in AFX connector capabilities to parse single or multi-valued responses in RSA Identity Governance & Lifecycle
• 000038206 -- There is no option to clear the mysql-connector-java-{version}-bin.jar file from the MySQL AFX connector template in RSA Identity Governance & Lifecycle
• 000038108 -- UserAccountControl (UAC) attribute PASSWD_CANT_CHANGE is not updated by the Active Directory AFX Connector in RSA Identity Governance & Lifecycle
• 000038091 -- RESTful Web Service AFX Connector fails when sending a DELETE request in RSA Identity Governance & Lifecycle
• 000038089 -- Microsoft Exchange 2010 AFX Connector Enable-mailbox command fails with 'Value cannot be null' in RSA Identity Governance & Lifecycle
• 000036921 -- How to update an Active Directory Account Attribute to have no value <not set> using an Active Directory AFX Connector in RSA Identity Governance & Lifecycle
• 000036913 -- Active Directory AFX Connector Add Account to Group capability fails with 'No Such Attribute' error in RSA Identity Governance & Lifecycle
• 000036685 -- SAP AFX Connector Update an Account capability fails to update any SAP account attributes in RSA Identity Governance & Lifecycle
• 000036543 -- SOAP Web Service AFX Connectors fail with 'Unable to get the WSDL' error in RSA Identity Governance & Lifecycle
• 000036423 -- Active Directory AFX Connector fails to create or modify accounts due to an 'LDAPException: Insufficient Access Rights' error in RSA Identity Governance & Lifecycle
• 000036217 -- 'Name or password is incorrect' error logging into SAP accounts created by the SAP AFX Connector in RSA Identity Governance & Lifecycle 
• 000036206 -- Oracle AFX test connector capabilities that have password parameters intermittently fail in RSA Identity Governance & Lifecycle
• 000035722 -- How to obtain an AFX SAP premium connector license for use with RSA Identity Governance & Lifecycle
• 000035713 -- Google Apps Data Collectors and AFX Connectors fails with authentication errors in RSA Identity Governance & Lifecycle
• 000035639 -- java.lang.NoClassDefFoundError when saving a JAVA Code Based AFX Connector in version 7.0.2 of RSA Identity Governance & Lifecycle
• 000035509 -- Database AFX test connector capabilities fail when using stored procedure OUT parameters in RSA Identity Governance & Lifecycle
• 000035200 -- RSA Archer GRC AFX Connector remains in a Deployed state in RSA Identity Governance & Lifecycle
• 000034949 -- How to install the AFX SAP premium connector license for use with RSA Identity Governance & Lifecycle
• 000034818 -- SSH AFX test connector settings fails with 'Request timed out' and a 'Kerberos username' warning in RSA Identity Governance & Lifecycle
• 000034572 -- Test connector settings of an Active Directory LDAP AFX Connector configured to use SSL over port 636 fails with 'Failed connector settings test, Request timed out' in RSA Identity Governance & Lifecycle 
• 000034482 -- 'Unable to save Connector' error when saving a JAVA Code Based AFX Connector in RSA Identity Governance & Lifecycle
• 000034248 -- SOAP Web Service AFX test connector capabilities fail with 'Failed to create service' and 'Unexpected EOF in prolog' messages in RSA Identity Governance & Lifecycle
• 000034185 -- Clicking on the Salesforce AFX Connector 'Get OAuth 2.0 Access Token' button results in a redirect_uri_mismatch error in RSA Identity Governance & Lifecycle
• 000034013 -- When editing/creating a SOAP Web Service AFX Connector and configuring any capability, a 'Request could not be handled' message is thrown in RSA Identity Governance & Lifecycle
• 000033926 -- ITIM 5.1 AFX test connector settings fail with 'Connection error: zip file closed' in RSA Identity Governance & Lifecycle
• 000033869 -- Questions on creating an AFX connector to PostgreSQL using a generic ODBC driver in RSA Identity Governance & Lifecycle
• 000033519 -- Active Directory AFX test connector capability fails with 'Invalid DN Syntax' and 'Error processing name' errors in RSA Identity Governance & Lifecycle
• 000033517 -- Active Directory AFX test connector capability fails with 'Invalid DN Syntax' and 'Error in attribute conversion operation' errors in RSA Identity Governance & Lifecycle
• 000032701 -- SOAP Web Service AFX test connector capabilities fail with 'Could not find service named' in RSA Identity Governance & Lifecycle
• 000032426 -- How to update the Active Directory UserAccountConrol (UAC) attribute with the Active Directory AFX Connector in RSA Identity Governance & Lifecycle
• 000030637 -- Active Directory AFX 'Disable/Enable an Account' connector capabilities do not update added parameters in RSA Identity Governance & Lifecycle
• 000030143 -- Data Collections and AFX Connectors from/to SQL Server endpoints fail when using the jTDS driver in RSA Identity Governance & Lifecycle
• 000029641 -- How to install the jTDS JDBC driver for use with AFX in RSA Identity Governance & Lifecycle

Notes

Example of each connector state: (In the RSA Identity Governance & Lifecycle user interface go to AFX > Connectors)

Image description