AD Import Jobs are getting failed

[SumathiSomala]

Hi Team,

We have scheduled to run Active Directory user/account/access import jobs once in a day in Saviynt.

Suddenly jobs are getting failed. We didn't make any changes to connection or in Active Directory side.

Also checked the certificate expiry date (12 Jan 2024)

Below error is printed in logs .

org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:546)Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.jndi.ldap.Connection.createSocket(Connection.java:398) at com.sun.jndi.ldap.Connection.<init>(Connection.java:220) ... 23 moreCaused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ... 25 moreCaused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ... 25 more

2023-11-22T10:55:10+05:30-ecm-ws.Restfulv5Controller-http-nio-8080-exec-105-DEBUG-Fetching certifications list
2023-11-22T10:55:10+05:30-ecm-campaigns.CampaignService-http-nio-8080-exec-105-INFO-Method Entry:getCertifications
2023-11-22T10:55:11+05:30-idwms-c.s.ssm.idwms.service.UsersService-http-nio-9091-exec-4-ERROR-Error in fetching User password expiry details :: {}|java.lang.NullPointerException: null| at com.saviynt.ssm.idwms.service.UsersService.getUserPasswordExpiryDetails(UsersService.java:559) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.idwms.service.UsersService.listUserActivity(UsersService.java:227) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.idwms.service.UsersService$$FastClassBySpringCGLIB$$6ecce1f0.invoke(<generated>) ~[classes!/:2021.1.0.0-SNAPSHOT]| at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) ~[spring-core-5.1.19.RELEASE.jar!/:5.1.19.RELEASE]| at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:687)

Any help would appreciated.

[smitg]

Hi @SumathiSomala ,

Please check SSL certificate associted with AD connection is still valid? 
Try importing the certificate and run the import jobs

Thanks,
Smitha

[Rajesh-R]

@SumathiSomala  - There might have been certificate update on the Active Directory.

Use the following command to check the certificate on the AD side:

• openssl s_client -connect <hostname>:<port>

Check if the certificate uploaded in Saviynt is same as the certificate provided as an output for this command.

[SumathiSomala]

@Rajesh-R Where we have to execute this command? 

[rushikeshvartak]

Does certificate is expired ? Try restarting server

[SumathiSomala]

@rushikeshvartak Certificate is not expired. expiry date is 12 Jan2024.Tried by restarting the server still no luck.

@Rajesh-R There might have been certificate update on the Active Directory--Will changes happen to the certificate on AD side without touching/modifying?

Since it was working earlier.

[Rajesh-R]

@SumathiSomala  -  The certificate can change in AD Domain Controller. Since the certificate is expring on Jan 2024, normally people renew it one month or two months prior. 

Please use the command I have shared to identify what certificate is tied to the active directory.

• openssl s_client -connect <hostname>:636

[SumathiSomala · Accepted solution]

Thanks everyone for your valuable and quick response.

Issue has been resolved. Customer has generated and uploaded the new certificate. Now jobs are successful.