Highlighted
Super Contributor.
Super Contributor.
1070 views

G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

Hi and thanks for taking the time to at least read this.

About a month ago, my G-Suite / Google Apps Driver started crashing with no recent changes anywhere in the configuration of IdM.  I thought I would try upgrading and patching to the hilt before any real troubleshooting, but that didn't help, and I can't figure out why it appears to be crashing on group creations.

I did notice a known issue document with the driver and the need to add a 5 second delay for what seems to be an unrelated issue, so I created a 10 second delay between group creations.  However, that didn't help either.

It's odd in that it seems to fail about 3 or 4 groups in.  However, sometimes it fails in on the first group creation/membership association.

Can you kindly have a look at the attached trace and see if anything jumps out or if you have any ideas as to what the fix might be, please?

I'm running Identity Manager 4.7.3.0 SE with GOOGLEAPPS 4.2.0.0.

Thanks a lot.

Bill

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Super Contributor.
Super Contributor.

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

I found an alternative way to get it (http://download.novell.com/protected/Summary.jsp?buildid=9nCyPKLQNWg~, for anyone interested).

I installed the update and it appears to have resolved my issue.  There seems to be a built-in retry, among other things, and it worked on about 15 groups memberships I tried at one time with a single user.  It's an improvement, anyway.

As an FYI, I get the following:

DirXML Log Event -------------------
Driver: \IDMVAULT\services\DriverSet\Google Apps
Channel: Subscriber
Status: Retry
Message: Code(-9006) The driver returned a "retry" status indicating that the operation should be retried later. Detail from driver: <description>GoogleJsonResponseException was thrown without a GoogleJsonError code</description>
<exception class-name="com.google.api.client.googleapis.json.GoogleJsonResponseException">
<message>404 Not Found


but it eventually processes the group membership.

Thanks for bouncing this around with me and hope your issues gets resolved soon.

View solution in original post

0 Likes
19 Replies
Highlighted
Knowledge Partner
Knowledge Partner

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

I suspect this  is because the Group does not exist yet.

Or the user does not exist.

 

Google is a bit strange as well since it is replicated all across the globe in a "random" way. I experience that there are timing issues.

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

Thanks for your response.

 

I suspected the same, so I was surprised when I inserted a 60 second delay between groups creations/modifications and the driver still crashed.

 

Do you think 60 seconds is long enough?  Any experience with setting higher delays?

 

Thanks again.

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution
No, I have not tried with s delay.
I Currently have an SR open for the same reason.
No reply yet though.
0 Likes
Super Contributor.
Super Contributor.

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

Don't bother.  I doubt it would work.  I am curious to find out what, if anything, your SR yields.  Please let me know what they say.  If it helps your case any, I decided to try adding a user account that has existed for years to a groups that has existed for years -- just a single group.  The GA driver crashed.  When I started the driver again, the membership was processed.  I have had to disable synchronizing groups,  just to process account creations.

Below is a basic trace, logging the olduser user account and oldgroup group account:

 

[-- SINGLE GROUP --]

[01/07/20 11:09:19.653]:GoogleApps ST:
DirXML Log Event -------------------
Driver: \IDMVAULT\services\DriverSet\Google Apps
Channel: Subscriber
Status: Fatal
Message: Code(-9005) The driver returned a "fatal" status indicating that the driver should be shut down. Detail from driver: <description>java.lang.NullPointerException</description>
<exception class-name="java.lang.NullPointerException">
<stack-trace>java.lang.NullPointerException
at com.novell.nds.dirxml.driver.gmailshim.DirectoryAppClient.patchGroup(DirectoryAppClient.java:2241)
at com.novell.nds.dirxml.driver.gmailshim.GMailSubscriptionShim.handleGroupModify(GMailSubscriptionShim.java:7501)
at com.novell.nds.dirxml.driver.gmailshim.GMailSubscriptionShim.modifyHandler(GMailSubscriptionShim.java:4446)
at com.novell.nds.dirxml.driver.gmailshim.GMailSubscriptionShim.dispatch(GMailSubscriptionShim.java:635)
at com.novell.nds.dirxml.driver.gmailshim.GMailSubscriptionShim.execute(GMailSubscriptionShim.java:511)
at com.novell.nds.dirxml.engine.Subscriber.execute(Subscriber.java:473)
at com.novell.nds.dirxml.engine.Subscriber.execute(Subscriber.java:304)
at com.novell.nds.dirxml.engine.Subscriber$ModifyProcessor.process(Subscriber.java:1760)
at com.novell.nds.dirxml.engine.Subscriber.processEvent(Subscriber.java:1197)
at com.novell.nds.dirxml.engine.Subscriber.processEvents(Subscriber.java:1010)
at com.novell.nds.dirxml.engine.Driver.submitTransaction(Driver.java:901)
at com.novell.nds.dirxml.engine.DriverEntry.submitTransaction(DriverEntry.java:1174)
at com.novell.nds.dirxml.engine.DriverEntry.processCachedTransaction(DriverEntry.java:1058)
at com.novell.nds.dirxml.engine.DriverEntry.eventLoop(DriverEntry.java:866)
at com.novell.nds.dirxml.engine.DriverEntry.run(DriverEntry.java:640)
at java.lang.Thread.run(Thread.java:748)
</stack-trace>
</exception>
<document xml:space="preserve">&lt;nds dtdversion="4.0" ndsversion="8.x">
&lt;source>
&lt;product edition="Standard" version="4.7.3.0">DirXML&lt;/product>
&lt;contact>NetIQ Corporation&lt;/contact>
&lt;/source>
&lt;input>
&lt;modify cached-time="20200107170918.237Z" class-name="Group" event-id="idmt#20200107170917#1#1:75a20162-8ad8-4169-8f3b-6201a275d88a" qualified-src-dn="O=vault\OU=groups\CN=oldgroup" src-dn="\IDMVAULT\vault\groups\oldgroup" src-entry-id="49109" timestamp="1578416958#2">
&lt;association state="associated">oldgroup@domain.edu&lt;/association>
&lt;modify-attr attr-name="Members">
&lt;add-value>
&lt;value association-ref="olduser@domain.edu" timestamp="1578416958#2" type="dn">\IDMVAULT\vault\users\oldusery&lt;/value>
&lt;/add-value>
&lt;/modify-attr>
&lt;/modify>
&lt;/input>
&lt;/nds></document>


[-- RESTARTED DRIVER --]

[01/07/20 11:09:38.111]:GoogleApps PT:-- trace suppressed --
[01/07/20 11:09:38.119]:GoogleApps PT:-- trace suppressed --
[01/07/20 11:09:38.122]:GoogleApps PT:-- trace suppressed --
[01/07/20 11:09:38.123]:GoogleApps PT:
DirXML Log Event -------------------
Driver: \IDMVAULT\services\DriverSet\Google Apps
Channel: Publisher
Status: Success
[01/07/20 11:09:48.832]:GoogleApps ST:
DirXML Log Event -------------------
Driver: \IDMVAULT\services\DriverSet\Google Apps
Channel: Subscriber
Object: \IDMVAULT\vault\groups\oldgroup
Status: Error
Message: <description>GoogleJsonResponseException: Member already exists.</description>
<exception class-name="com.google.api.client.googleapis.json.GoogleJsonResponseException">
<message>409 Conflict
{
"code" : 409,
"errors" : [ {
"domain" : "global",
"message" : "Member already exists.",
"reason" : "duplicate"
} ],
"message" : "Member already exists."
}</message>
</exception>
[01/07/20 11:09:48.837]:GoogleApps ST:
DirXML Log Event -------------------
Driver: \IDMVAULT\services\DriverSet\Google Apps
Channel: Subscriber
Object: \IDMVAULT\vault\groups\oldgroup
Status: Success

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

f you have a possibility to open up an SR for this I would do it.

The biggest problem is that the driver crashes, it should behave in a nicer way.

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

I couldn't help but notice that Concensus has a patch to 4.2.0.0 (https://concensus.jira.com/wiki/spaces/RS/pages/610205697/G-Suite+Driver+4.2.0.1).  Interestingly, I don't have ctgmailshim.jar in my NetIQ install of IdM and the GA Driver.  There are also a few discrepancies in dependencies, newer versions on the Concensus site that make me wonder if they would resolve the issue(s) that we are running into.  I wouldn't advise installing anything outside of the supported environment, but I am left to wonder if NetIQ trailing behind with updates could easily be resolved from these files from the developer.

Please let me know what, if anything, you hear back from NetIQ.

Thanks

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution
Microfocus has just released a patch that seem to fit this description.

IDM 4.7 Google Apps Driver Version 4.2.0.1

Patch for the MicroFocus Identity Manager Google Apps Driver. This will take the driver build version to 4.2.0.1
This is a hot fix release for version 4.2.0.0. It corrects a problem with mal-formed error responses from Google API servers which occur occasionally from group operations.
The only updated file is gmailshim.jar. If updating from 4.2.0.0, no other changes are required.


https://dl.netiq.com/Download?buildid=9nCyPKLQNWg~

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

Thank you for bringing this to my attention.  Have you been able to test and see whether this resolves the group issue?

I would have tried it, but it seems I am not "authorized" to download it, even tho we are under a maintenance contract.

Thanks again.

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution
Strange, anyone should be able to download it.

I applied it earlier but have not tried it on group yet.
My problem was with ou and that is not fixed. Diffrent problem though.
0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

I found an alternative way to get it (http://download.novell.com/protected/Summary.jsp?buildid=9nCyPKLQNWg~, for anyone interested).

I installed the update and it appears to have resolved my issue.  There seems to be a built-in retry, among other things, and it worked on about 15 groups memberships I tried at one time with a single user.  It's an improvement, anyway.

As an FYI, I get the following:

DirXML Log Event -------------------
Driver: \IDMVAULT\services\DriverSet\Google Apps
Channel: Subscriber
Status: Retry
Message: Code(-9006) The driver returned a "retry" status indicating that the operation should be retried later. Detail from driver: <description>GoogleJsonResponseException was thrown without a GoogleJsonError code</description>
<exception class-name="com.google.api.client.googleapis.json.GoogleJsonResponseException">
<message>404 Not Found


but it eventually processes the group membership.

Thanks for bouncing this around with me and hope your issues gets resolved soon.

View solution in original post

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: G-Suite / Google Apps Driver Crashing on Group Creation

Jump to solution

On another list I am on, the author of the Consensus/NetIQ GApps shim explained the issues as he had fixed them.

Two issues lately - 1 API deprecation.  Google ditched the API it had been using.

2 - Timing issue on moves/renames since the shim queries the object and may get a stale object from Google.  Work to clean that up.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.