Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-3283: ZPA fails to provision with error "given key was not present in dictionary"

Centrify DirectControl ,  

12 April,16 at 11:12 AM

Applies to: All versions of Centrify Zone Provisioning Agent 
 
Question:
 
The following error is seen in the ZPA log when provisioning and ZPA stops provisioning. 
 
Restarting ZPA makes no difference. Is there any reason for this?
 
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll: Failed to update zone Global/Centrify/Zones/Master : System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary. 
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll:    at Centrify.Cfw.DirectoryServices.LateBindingDictionary`2.get_Item(TKey key)
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll:    at Centrify.Cfw.DirectoryServices.Group.MemberCollection.MemberEnumerator.MoveNextMemberDN()
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll:    at Centrify.Cfw.DirectoryServices.Group.MemberCollection.MemberEnumerator.MoveNext()
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll:    at Centrify.Provisioning.ZoneWorker.EnumerateUserProfileSource(GroupPrincipal source)
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll:    at Centrify.Provisioning.ZoneWorker.Run()
[2013-06-10 16:53:38.258 -0700] Centrify.Provisioning.Agent.exe[3880,6] Error: DomainPoller.Poll:    at Centrify.Provisioning.ProvisioningWorker.DomainPoller.Poll() 
 
Answer:
 
This is because a contact object was added in the AD group which ZPA is provisioning.
 
A contact object contains contact info about any person associated with the organization like a supplier’s telephone number, mail address etc. 
For example an organization might want to store details of people who are not directly associated with the organization such as people who help in network maintenance or suppliers etc. 
These people usually do not need to be given access to AD; only their details need to be stored which in this case is their name and contact information., 
This can be done using a contact object.
 
ZPA can provision only user AD objects which contains information about users like their first, middle and last names, login credentials etc. 
ZPA does support DLG (Distribution List groups) in AD when used in provisioning users or groups.
 
Removing the contact object from the AD provisioning group  should resolve the issue.
 
The following KB can be used to identify these contact objects:
  • KB-2937: Script to check invalid group member SIDs if "Show Effective users fails"
 
 
Future versions may provide a mechanism to skip over if a contact object is found (rather than fail to provision).

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.