Troubleshooting Guide for Ad-based application integrated with ServiceNow

Application – AD-based application (Roles)

Approvers – Two levels. First level – manager and 2nd level – application team

Ticket moved to Incomplete State

Issues:

• ServiceNow configuration issue

o   Incorrect or missing configuration in ServiceNow may prevent the ticket from completing successfully.

• Mismatch in Service Item configuration

o The service item name may be spelled or configured differently between SailPoint and ServiceNow, causing synchronization failures.

• Manual closure of RITM

o   The RITM may been manually moved to the closed incomplete state by an administrator or support team. If the requested access is already assigned to the user

• User already assigned the access

o  The user request for the access that is already assigned, the ticket moves to an incomplete state

Solution

• Validate ServiceNow configuration

o  Review and verify all relevant ServiceNow configurations to ensure they align with the integration requirements

• Cross- check service item names

o  Compare the service item names and configuration in SailPoint and ServiceNow to ensure consistency and correct mappings

• Verify existing access

o  Confirm whether the requested access is already assigned to the user, which may have resulted in the ticket being closed as incomplete

RITM completed successfully but access was not provisioned

Issues:

• Ad group not mapped to role

o   The Active Directory group may not be mapped correctly, or the role does not contain the required entitlement.

• Missing or incorrect entitlement mapping

o   The entitlement associated with the role may not exist or may be mismatched in SailPoint

• Target system unavailable

o   The target may be inactive, unreachable, or experiencing a VA issue, preventing access provisioning

Solution

• Validate entitlement in SailPoint           

o   the entitlement name in SailPoint and verify it matches exactly with the entitlement name in the target system. In some cases, naming differences between SailPoint and the target application can prevent provisioning

• Aggregate the target sources

o   if the entitlement is not available in SailPoint, perform a source aggregation to fetch the latest entitlements for the target system.

• Verify target system and A status

o   Check whether the target system and its VA/connector are active and reachable

• Restore connectivity and retry provisioning

o   Once the target system is available, retry the provisioning request from SailPoint

Approval workflow not working as expected

Issues:

• Incorrect Approval Routing

o   The approval request was routed to ITSO or BPO instead of the group members

• Incorrect Approver assignment

o   The approval was sent to unintended members rather than the assigned or configured approvers

• Manager approval skipped

o   The workflow bypassed the manager approval step and moved directly to group-level approval

• Approval sent to outdated approver

o   The request was routed to a previously configured approver instead of the current approver.

Solution

• Verify entitlement to group mapping

o   Ensure the correct group members are associated with the entitlement and that the approver group is accurately defined

• Review ServiceNow workflow configuration

o   Validate approval flows in ServiceNow to confirm correct approver determination

• Validate approver configuration and changes

o   Check for recent changes in approver assignments and ensure the workflow is updated to reflect the current approvers

Access not found in ServiceNow

Causes

• Role not yet migrated to SailPoint

o   The requested role has not been onboarded or migrated from the legacy portal system into SailPoint

RITM struck at SailPoint verification/ aggregation failure

Causes

• Query issue

o   If the attributes are multivalued, the query must be constructed accordingly.

• VA update in progress

o   During the VA update, all the source systems connected to the affected VA may experience connectivity issues.

o   Connected sources may encounter timeout errors, resulting in provisioning or aggregation requests getting struck at the SailPoint verification stage

Solution

• Analyze the attribute structure and values in the target system before onboarding it into SailPoint

• Confirm whether attributes are single-vales or multivalued and design the query logic

• Monitor the VA update status and wait until the update is completed successfully.

• Once the VA is back online, re-initiate or retry the impacted requested to ensure successful processing.