Azure AD Connector (classic) failing

[BarCar]

I'm trying to set up the classic connector for Azure AD and have followed the documentation to the best of my ability.

When I click "Save and Test Connection" I get the generic "Error while Test Connection: Connection Failed".

I have tried the following:

1. validated that the credentials I am using are working (via Postman),
2. validated that the ACCOUNT_IMPORT_FIELDS is ok (also via Postman).
3. validated that the ACCOUNT_ATTRIBUTES property is valid JSON
4. updated the STATUS_THRESHOLD_CONFIG to make the documentation
5. enabled showlogs in the ConfigJSON
6. searched the logs and not found anything of note
7. contacted support who also tested and did not find anything of note

"Support" suggested that I post here since this is setting up a new connector. Can anybody help me get this working?

Do I need to provide a certificate for this connection? I didn't see that mentioned in the documentation at Configuring the Integration for Account and Group Import (saviyntcloud.com)

Thanks.

[khalidakhter]

Hi @BarCar 

Please share the debug log for Save & Test action to see if I can get any pointers about the issue.

[BarCar · Accepted solution]

So, I solved this with the help of our Professional Services team. Support were really no help.

The documentation at Configuring the Integration for Account and Group Import (saviyntcloud.com) is pretty misleading.

It provides default values for the Authentication, Graph and Azure Endpoints. If you specify these in your connector it fails with an HTTP 400 error.

Professional Services advised me to clear these values and re-test. Bingo - it connected immediately.

I have no idea why specifying the recommended values failed and why the error message was worse than useless but it's working now. Maybe this will help somebody else in future.

[khalidakhter]

@BarCar 

Can you please share the Endpoint URL configured earlier in the Azure AD connection?

[BarCar]

Per the documentation link above, the endpoint URLs that I used were:

• AUTHENTICATION_ENDPOINT: https://login.microsoftonline.com/
• MICROSOFT_GRAPH_ENDPOINT: https://graph.microsoft.com/
• AZURE_MANAGEMENT_ENDPOINT: http://management.azure.com/

Note that the Azure endpoint is listed in the documentation as HTTP, not HTTPS - I assume this is a documentation error - so I tried HTTPS - it failed with both.

[khalidakhter]

Hi @BarCar 

Seems like a documentation error clearly. It must work with below endpoint URLs:

• AUTHENTICATION_ENDPOINT: https://login.microsoftonline.com
• MICROSOFT_GRAPH_ENDPOINT: https://graph.microsoft.com
• AZURE_MANAGEMENT_ENDPOINT: https://management.azure.com

[BarCar]

Yes, It should. But it didn't. Only specifying null values allowed it to connect.

[SB]

@BarCar  There is an extra forward slash (/) at the end of the url's which should not be there. We are working on getting this updated in the Doc as well.

[shibinvpkvr]

@BarCar This is helpful as I had the same problem today and after clearing out those URLs it started working. 

[sampath18]

Hi Guys, 

can anyone share working connection json for Azure AD connection. we are following the document and getting http status code as 400 error. But in postman we are able to connect successfully. below is the connection we are using. so please correct me where i am doing wrong

{
"authentications": {
"userAuth": {
"authType": "oauth2",
"url": "https://login.chinacloudapi.cn/********/oauth2/token",
"httpMethod": "POST",
"httpParams": {
"grant_type": "client_credentials",
"client_id": "********"
"client_secret": "******"
},
"httpHeaders": {
"contentType": "application/x-www-form-urlencoded"
},
"httpContentType": "application/x-www-form-urlencoded",
"expiryError": "ExpiredAuthenticationToken",
"authError": [
"InvalidAuthenticationToken"
],
"retryFailureStatusCode": [
401
],
"timeOutError": "Read timed out",
"errorPath": "error.code",
"maxRefreshTryCount": 5,
"tokenResponsePath": "access_token",
"tokenType": "Bearer",
"accessToken": "Bearer abcd "
}
}
}

[naveenss]

Please try the below JSON

{
    "authentications": {
        "userAuth": {
            "authType": "oauth2",
            "url": "https://login.microsoftonline.com/<tenant_id>/oauth2/token",
            "httpMethod": "POST",
            "httpParams": {
                "grant_type": "client_credentials",
                "client_id": "<client_id>",
                "client_secret": "<client_secret>",
                "resource": "https://graph.microsoft.com/"
            },
            "httpHeaders": {
                "Content-Type": "application/x-www-form-urlencoded"
            },
            "httpContentType": "application/x-www-form-urlencoded",
            "authError": [
                "Unable to authenticate the client",
                "Invalid OAuth token Bearer"
            ],
            "retryFailureStatusCode": [
                401,
                403
            ],
            "errorPath": "",
            "maxRefreshTryCount": 5,
            "tokenResponsePath": "access_token",
            "refreshType": "RefreshToken",
            "tokenType": "Bearer",
            "accessToken": "Bearer abcd"
        }
    }
}

. Please replace <tenant_id>, <client_id> and <client_secret> as per your instance. 

[sampath18]

Hi @naveenss Thanks for quick response.

 I believe above connection json is working in your environment. Because it looks same as saviynt documentation https://docs.saviyntcloud.com/bundle/AzureAD-v23x/page/Content/Configuring-the-Integration-for-Provi...

I tried with above json and it is still failing.

Thanks,
Sampath

[naveenss]

do you see any error in logs? if yes, can you pls share it here?

[sampath18]

Hi @naveenss i have attached the logs for reference. However, below is one error code i could find in logs.

Also, i have question that whether we should use REST connection or Azure AD connection type while with azure provisioning operations. document says user REST connection. but i was using AzureAD connection type. is that not supported?

azure.AzureProvisioningService - microSoft token API statusCode: 400\n","stream":"stdout","time":"2023-06-16T14:06:26.238223543Z"}"

Thanks
Sampath

[naveenss]

Hi @sampath18 ,

If it's for provisioning use REST. For imports use standard AzureAD connector.

[sampath18]

Hi @naveenss  we are able to connect azure AD tenant using rest connector. But as per document if we want to import accounts we need to use azure AD connection type. When we are trying to connect with Azure AD connection type then we are getting connection failed message.  Do we need to provide connection json for azureAD type connector as well.? I tried using connection json which is working in REST based connector but still the connection is failing.

Thanks,
Sampath

[naveenss]

Hi @sampath18 ,

For AzureAD connection Type connection JSON is not required. You just need to provide client_id, client_secret, AAD_TENANT_ID. 

[sampath18]

Hi @naveenss  Thank you so much for confirming that. I was able to fix issue after providing valid endpoint url for my use case.

I have provided above details along with following azure endpoint urls. Here we are connecting to azure china tenant

AUTHENTICATION_ENDPOINT: https://login.chinacloudapi.cn

MICROSOFT_GRAPH_ENDPOINT: https://microsoftgraph.chinacloudapi.cn

AZURE_MANAGEMENT_ENDPOINT: https://management.chinacloudapi.cn

Thanks
Sampath