Google Apps Connector SCIM Peer Not Authenticated Error During Endpoint Operations

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

When attempting to update or create a Google Apps (G-Suite) endpoint using the SCIM connector in Identity Manager, the operation may fail with a "peer not authenticated" error. This often occurs when running etautil commands to update encrypted attributes, such as the private key.

Users may encounter the following error in the logs or command line:

ETA_E_0020, User Account '####' on 'DYN-Endpoint' read failed: Connector Server Add failed: code 53 (UNWILLING_TO_PERFORM): failed to modify entry... SCIM: peer not authenticated (ldaps://##.##.##.##:20411)

Additionally, an error regarding "Error decrypting attribute eTDYN-str-multi-ca-06" may be observed when running: etautil -u USER -p PWD -dyn update 'eTNamespaceName=MyEndpointType' eTDYNDirectory eTDYNDirectoryName='MyEndpoint' eTDYN-str-multi-ca-06='GSuite-PrivateKey'

Environment

Identity Manager 14.x

Cause

The Java Connector Server (JCS) is unable to establish a secure handshake with the G-Suite API Gateway because the Gateway's SSL/TLS certificate is not trusted by the Connector Server's keystore.

Resolution

Import the API Gateway certificate into the Connector Server to establish trust.

1. Access the Connector Server Admin UI (typically at https://[JCS_IP]:20443/main).
2. Navigate to the Certificates tab.
3. Click Add.
4. Enter the API Gateway certificate details or upload the certificate file.
5. Once the certificate is successfully imported, restart the Connector Server service if necessary.
6. Re-run the etautil command or attempt the endpoint creation again.

Additional Information

This error can be thrown upon endpoint creation and the resolution would be the same. Import the API gateway certificate into the connector server.