We are delighted to share our new EIC Delivery Methodology for efficiently managing Saviynt Implementations and delivering quick time to value. CLICK HERE.

AD Import Jobs are getting failed

SumathiSomala
All-Star
All-Star

Hi Team,

We have scheduled to run Active Directory user/account/access import jobs once in a day in Saviynt.

Suddenly jobs are getting failed. We didn't make any changes to connection or in Active Directory side.

Also checked the certificate expiry date (12 Jan 2024)

Below error is printed in logs .

org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:546)Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.jndi.ldap.Connection.createSocket(Connection.java:398) at com.sun.jndi.ldap.Connection.<init>(Connection.java:220) ... 23 moreCaused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ... 25 moreCaused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ... 25 more

2023-11-22T10:55:10+05:30-ecm-ws.Restfulv5Controller-http-nio-8080-exec-105-DEBUG-Fetching certifications list
2023-11-22T10:55:10+05:30-ecm-campaigns.CampaignService-http-nio-8080-exec-105-INFO-Method Entry:getCertifications
2023-11-22T10:55:11+05:30-idwms-c.s.ssm.idwms.service.UsersService-http-nio-9091-exec-4-ERROR-Error in fetching User password expiry details :: {}|java.lang.NullPointerException: null| at com.saviynt.ssm.idwms.service.UsersService.getUserPasswordExpiryDetails(UsersService.java:559) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.idwms.service.UsersService.listUserActivity(UsersService.java:227) ~[classes!/:2021.1.0.0-SNAPSHOT]| at com.saviynt.ssm.idwms.service.UsersService$$FastClassBySpringCGLIB$$6ecce1f0.invoke(<generated>) ~[classes!/:2021.1.0.0-SNAPSHOT]| at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218) ~[spring-core-5.1.19.RELEASE.jar!/:5.1.19.RELEASE]| at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:687)

 

Any help would appreciated.

 

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.
7 REPLIES 7

smitg
Regular Contributor III
Regular Contributor III

Hi @SumathiSomala ,

Please check SSL certificate associted with AD connection is still valid? 
Try importing the certificate and run the import jobs

Thanks,
Smitha

Rajesh-R
Saviynt Employee
Saviynt Employee

@SumathiSomala  - There might have been certificate update on the Active Directory.

Use the following command to check the certificate on the AD side:

  • openssl s_client -connect <hostname>:<port>

Check if the certificate uploaded in Saviynt is same as the certificate provided as an output for this command.


Thanks
Rajesh Ramalingam
Saviynt India

@Rajesh-R Where we have to execute this command? 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

rushikeshvartak
All-Star
All-Star

Does certificate is expired ? Try restarting server


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

SumathiSomala
All-Star
All-Star

@rushikeshvartak Certificate is not expired. expiry date is 12 Jan2024.Tried by restarting the server still no luck.

@Rajesh-R There might have been certificate update on the Active Directory--Will changes happen to the certificate on AD side without touching/modifying?

Since it was working earlier.

 

 

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.

Rajesh-R
Saviynt Employee
Saviynt Employee

@SumathiSomala  -  The certificate can change in AD Domain Controller. Since the certificate is expring on Jan 2024, normally people renew it one month or two months prior. 

Please use the command I have shared to identify what certificate is tied to the active directory.

  • openssl s_client -connect <hostname>:636

Thanks
Rajesh Ramalingam
Saviynt India

SumathiSomala
All-Star
All-Star

Thanks everyone for your valuable and quick response.

Issue has been resolved. Customer has generated and uploaded the new certificate. Now jobs are successful.

Regards,
Sumathi Somala
If this reply answered your question, please Accept As Solution and give Kudos.