Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-2556: ZPA stopped provisioning user with error "The group's SID could not be resolved."

Authentication Service ,   Mac & PC Management Service ,  

12 April,16 at 11:32 AM

Applies to:

Centrify Zone Provisioning Agent version 5.0.3 or below on Windows OS
ZPA stopped provisioning users with the following errors in the log:
Failed to retrieve users from provisioning source ORACLE_Users@ILTEST.NET. 
An error (1301) occurred while enumerating the groups. 
The group's SID could not be resolved. ILTEST.NET/Centrify/Zones/


Error: Failed to retrieve groups from provisioning source <groupname>@<domainname>.  While trying to resolve a cross-store reference, the SID of the target principal could not be resolved.  The error code is 1788.
In the source group (or member of the source group), there are one or more users/groups whose SID were not resolvable and caused the .NET framework to throw out an exception. These exceptions caused ZPA to stop provisioning.
Open and expend each member of the source group to find the non-resolvable users and groups (CN=S-1-xxxxxxx) and remove them:
CN=S-1-5-21-.... is the object that cannot be resolved.



This will be fixed in a future release.