Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-2556: ZPA stopped provisioning user with error "The group's SID could not be resolved."

Centrify DirectControl ,   Centrify Identity Service, Mac Edition ,  

12 April,16 at 11:32 AM

Applies to:

Centrify Zone Provisioning Agent version 5.0.3 or below on Windows OS
 
Problem:
 
ZPA stopped provisioning users with the following errors in the log:
 
Failed to retrieve users from provisioning source ORACLE_Users@ILTEST.NET. 
An error (1301) occurred while enumerating the groups. 
The group's SID could not be resolved. ILTEST.NET/Centrify/Zones/

OR

Error: Failed to retrieve groups from provisioning source <groupname>@<domainname>.  While trying to resolve a cross-store reference, the SID of the target principal could not be resolved.  The error code is 1788.
 
Cause:
 
In the source group (or member of the source group), there are one or more users/groups whose SID were not resolvable and caused the .NET framework to throw out an exception. These exceptions caused ZPA to stop provisioning.
 
Workaround:
 
Open and expend each member of the source group to find the non-resolvable users and groups (CN=S-1-xxxxxxx) and remove them:
 
CN=S-1-5-21-.... is the object that cannot be resolved.























 






Resolution:

This will be fixed in a future release.

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.