Looking at the trace, you are using a Remote Loader (which is pretty typical for engine on Linux, connecting to AD).

In the Remote Loader config file (edit as a Text file)  you should add the parameter on the -connect line of handshaketimeout=10000 to get 10 seconds to handshake.

Cannot find it in the 4.9 docs but was easy to find in 4.7 but same values.

https://www.netiq.com/documentation/identity-manager-47/driver_admin/data/b18xta1v.html

Watch out that when you use Rlconsole.exe to manage/modify the RL configuration that you double check this setting is not lost. (It is not exposed in the GUI alas).

I've experienced this too, a couple of times. In our environment we have handshaketimeout=20000 added to the "Remote loader connection parameters" on the IDM driver side. Didn't have this configured on the remote loader, didn't realise that was an option but that's a good shout. One or both should do the trick.

I also noticed this in my test network environment where resources are not as plentiful compared to the production cluster.

Jon

Hi Geoffrey, after adding handshaketimeout=10000 string in connection, theres no more timeout error, however new error came "invalid remote loader password"  and "invalid driver password" or something, i had to retype the password in RLconsole.exe then it works. not sure if this is due to after we just recently upgraded Remote Loader

I remember having that, searched for information on it and at the time it was a known issue on the remote loader. That was after an upgrade too.

This was my situation after upgrading to 4.8.6:-

www.netiq.com/.../t4joxs1cu982.html

Jon

The handshaketimeout setting was in 4.0.2 possibly also in earlier versions, and it has been a know problem that if there was just the slightest timeout in the connection to / from the Remote Loader then it would fail.

The password corruption problem have been an on/off problem for years, for some odd reason the password gets corrupted and you have to do as described in the documentation to fix it (remove, save, set, save). I have seen it happening after a restart (not upgrade). Unfortunately they do not save the password as a named-password, which makes it impossible to read it out to see what it was changed to.

It is there, in the Driver Admin Guide: https://www.netiq.com/documentation/identity-manager-49/driver_admin/data/b18xta1v.html

I remember when there was a separate guide for the Remote Loader, that made it easier.

Thanks for the insight. I will always be wary of that in future upgrades in that case.

Jon