12.6 Troubleshooting Provisioning Issues

Use the information in the following sections to troubleshoot provisioning issues.

12.6.1 Capturing Logs for Provisioning Issues

By default, when you provision users, the appliance does not log any information about the provisioning process. Enabling logging causes performance issues, so you should never leave the logging running all of the time.

However, if you have provisioned users and select accounts are not showing up in the SaaS applications, you will need to enable logging to capture the cause.

To capture logs of provisioning issues:

  1. Determine which account (or accounts) were not provisioned.

  2. Remove that account from the group that grants access to the SaaS application.

  3. Turn on logging:

    1. Access the Admin page of the appliance console.

    2. Under Appliances, click the Node icon, then click Enter troubleshooting mode.

    3. Click the Node icon again, then click Troubleshooting tools.

    4. Select Provisioning, then click Apply and OK.

  4. Add the user to the group or initiate the provisioning action.

  5. Access the troubleshooting tools again.

  6. Click Download CloudAccess Log Files to download the logs.

  7. Deselect Provisioning, then turn off troubleshooting mode.

  8. Review the logs to find the error when provisioning occurs.

Ensure that you have turned off troubleshooting mode, otherwise it will cause performance problems with the appliance.

12.6.2 Understanding the Result of Actions Performed on Users and Groups

Actions that are taken on users and groups in the identity source might not be reflected in the SaaS applications (Google Apps, Salesforce, and Office 365). The following table lists the actions in the identity sources and the corresponding actions in the SaaS applications.

Table 12-3 Provisioning Actions

Identity Sources

SaaS Applications

Delete a user. (Or disable a user account.)

Disables the SaaS account.

NOTE:In the MobileAccess app an iOS device, the user continues to have access to the SaaS account until the in-progress user session times out.

Remove a user from the authorized group.

Disables the SaaS account.

Create a user.

  • Creates an account for the user in the SaaS application, if the user is a member of a group with mapped SaaS authorizations.

    or

  • Users are prompted to validate their information when they log in the first time.

Move a user from out of the search context into the search context.

Creates an account for the user in the SaaS application, if the user is a member of a group with mapped SaaS authorizations.

Move a user out of the search context.

Disables the SaaS account.

By default, CloudAccess establishes identity based on an internal unique ID in the identity source, not based on the user name, and does not support recreating users with the same name unless they also have the same internal unique ID. Once a user has been mapped and provisioned, if you delete the user from the identity source and then recreate that user with the same name, you will not be able to cache and activate the user in CloudAccess or provision the user to SaaS applications. When CloudAccess is unable to cache users properly, the Cached User Status Bar indicates this status with a lower number of active users than cached users.

IMPORTANT:CloudAccess does provide a Relaxed user matching option under Advanced Options on the configuration window for the identity source. If you select this option, CloudAccess matches users based on CN or sAMAccountName instead of the internal unique ID. This option enables you to recreate previously deleted users so CloudAccess can manage them again, but you must ensure that you do not create different users with the same CN or sAMAccountName as previously deleted users. Otherwise, those users will have access to the previously deleted users’ cloud application data.