IBM 2.0 Security Privileged Identity Manager Error Message Guide

IBM Security Privileged Identity Manager
Version 2.0
Error Message Guide
IBM Security Privileged Identity Manager
Version 2.0
Error Message Guide
Note
Before using this information and the product it supports, read the information in Notices.
Edition notice
Note: This edition applies to Version 2.0 of IBM Security Privileged Identity Manager (product number 5725-H30)
and to all subsequent releases and modifications until otherwise indicated in new editions.
© Copyright IBM Corporation 2013, 2014.
US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract
with IBM Corp.
Contents
Figures . . . . . . . . . . . . . . . v
Tables . . . . . . . . . . . . . . . vii
Messages . . . . . . . . . . . . . . 1
Message format . . . . . . . . .
Workflow management messages . . .
Lifecycle management messages . . .
Post office management messages . . .
Remote services messages . . . . .
Policy messages . . . . . . . . .
Data services messages . . . . . .
Service management messages . . . .
Password management messages . . .
Account management messages . . .
Form customization messages . . . .
Import and export management messages
© Copyright IBM Corp. 2013, 2014
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 1
. 1
. 22
. 28
. 34
. 49
. 57
. 60
. 67
. 72
. 80
. 85
Web client messages . . . . . . . . . .
Authentication response messages . . . . . .
Reporting messages . . . . . . . . . .
Common messages . . . . . . . . . .
Installation and configuration messages . . .
Role management messages . . . . . . .
Container management messages . . . . . .
Adapter management messages . . . . . .
Service Center messages . . . . . . . . .
Privileged identity management and data
synchronization . . . . . . . . . . .
Web Services messages . . . . . . . . .
IBM Security Privileged Identity Manager REST
services . . . . . . . . . . . . . .
Shared access messages . . . . . . . . .
. 88
. 90
. 96
. 100
. 107
. 108
. 111
. 115
. 124
. 125
. 132
. 133
. 135
Notices . . . . . . . . . . . . . . 141
iii
iv
IBM Security Privileged Identity Manager: Error Message Guide
Figures
© Copyright IBM Corp. 2013, 2014
v
vi
IBM Security Privileged Identity Manager: Error Message Guide
Tables
© Copyright IBM Corp. 2013, 2014
vii
viii
IBM Security Privileged Identity Manager: Error Message Guide
Messages
Messages provide information to help you diagnose and resolve problems that you
might encounter.
Message format
Messages that are generated by IBM® Security Privileged Identity Manager contain
eight character identifiers.
Workflow management messages
CTGIMA001E An error occurred while processing
the following JavaScript. JavaScript:
javascript The following error occurred.
Error: error_text
Explanation: An error occurred with the specified
JavaScript. The error text provides further details about
the error.
Administrator response: Fix the JavaScript code based
on the error text.
A JavaScript interpreter error occurred when the XTTL
component processed the specified JavaScript
command. A message is written to the log file.
CTGIMA002E A configuration error occurred while
processing dynamic content. The
variable_name environment variable is
missing from the environment_map
dynamic content execution environment
map.
Explanation: The environmental variable identified in
the message cannot be found. This is an internal error.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
The specified environment variable is missing from the
specified XTTL execution map. This error occurred
because the calling code did not populate the
environment variable.
CTGIMA003E A dynamic content tag is not
recognized. An error occurred parsing
the element located near line line_number
and column column_number. The
following message was received while
parsing the XML code: xml_message
Explanation: An error occurred while parsing a
dynamic content tag that was specified in the template.
© Copyright IBM Corp. 2013, 2014
Ensure that the element is coded correctly. For example,
ensure that the tag has both starting and ending tags
coded correctly and that any special escaped characters
are coded.
Administrator response: Fix the dynamic content
template, and start the workflow process again.
An error occurred when the XTTL component
processed the notification template. A message is
written to the log file.
CTGIMA004E The key attribute or element is
missing from the RE dynamic content
tag. Processing of the dynamic message
content is stopped.
Explanation: An error occurred while parsing the RE
tag that is used to specify string replacement. The
required key attribute or element is missing.
Administrator response: Specify the key attribute on
the RE tag or KEY tag, and start the workflow process
again.
An error occurred when the XTTL component
processed the RE dynamic content tag that was
specified in the aggregated message notification
template. A message is written to the log file.
CTGIMA005E The name attribute is missing from
the RB dynamic content tag. Processing
of the dynamic content is stopped.
Explanation: An error occurred while parsing the RB
tag, which is used to specify a resource bundle for a
work order element. The required name attribute is
missing.
Administrator response: Specify the name attribute on
the RB tag, and start the workflow process again.
An error occurred when the XTTL component
processed the RB tag for a work element. A message is
written to the log file.
1
CTGIMA006E • CTGIMA014E
CTGIMA006E The xml_element_name XML element
cannot be processed. The element is
located near line line_number and
column column_number.
Explanation: The element specified in the dynamic
content is not a valid element.
Administrator response: Fix the dynamic content
template, and start the workflow process again.
An error occurred when the XTTL component detected
a coding problem in the aggregated message
notification template. A message is written to the log
file.
CTGIMA007E An error occurred parsing the
xml_element XML element near line
line_number and column column_number.
Explanation: The element specified in the dynamic
content is not a valid element.
Administrator response: Fix the dynamic content
template, and start the workflow process again.
An error occurred when the XTTL component detected
an aggregated message notification template coding
problem. A message is written to the log file.
CTGIMA008E The Reminder Interval field value is
not valid. Enter an integer of one or
greater.
Explanation: The value specified for the Reminder
Interval field is not correct. The value must be equal to
or greater than one day.
Administrator response: Change the value for the
Reminder Interval field.
A configuration error occurred for the To Do reminder
component. A message is written to the log file.
CTGIMA009E The interval value is not valid. The
value for the Reminder Interval field
must be less than or equal to the value
specified for escalation time.
Explanation: The value for the Reminder Interval field
is not correct. Enter a value less than or equal to the
escalation time, which is specified in the Escalation
Limit field.
Administrator response: Change the value for the
Reminder Interval field.
A configuration error occurred for the To Do reminder
component. A message is written to the log file.
2
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA010E The value in the XHTML Body field
for the template_name workflow
notification template exceeds the
maximum number of characters. The
maximum number of characters for this
field is 50 000.
Explanation: The XHTML Body field for the specified
template exceeds the maximum number of characters.
The value must contain fewer than 50 000 characters.
Administrator response: Reduce the number of
characters in the XHTML Body field.
A configuration error occurred for the To Do reminder
component. A message is written to the log file.
CTGIMA011E The value in the Text Body field for
the template_name workflow notification
template exceeds the maximum number
of characters. The maximum number of
characters for this field is 4 000.
Explanation: The Text Body field for the specified
template exceeds the maximum number of characters.
This value must contain fewer than 4 000 characters.
Administrator response: Reduce the number of
characters in the Text Body field.
A configuration error occurred for the To Do reminder
component. A message is written to the log file.
CTGIMA012E The value in the Subject field for the
template_name workflow notification
template exceeds the maximum number
of characters. The maximum number of
characters for this field is 2000.
Explanation: The Subject field for the specified
template exceeds the maximum number of characters.
The value must contain fewer than 2000 characters.
Administrator response: Reduce the number of
characters in the Subject field.
A configuration error occurred for the To Do reminder
component. A message is written to the log file.
CTGIMA014E To Do Reminder configuration data
for the organization_name organization
cannot be retrieved.
Explanation: The configuration data for the To-Do
Reminder template cannot be retrieved from the LDAP
database. This data is specified on the Workflow
Notifications page.
Administrator response: Verify that the LDAP server
is available and that there are no network outages, and
then try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMA015E • CTGIMA023E
A configuration error occurred for the To-Do Reminder
component. An attempt to retrieve the configuration
data from the LDAP database failed. Review the
scheduler code for problems. A message is written to
the log file.
CTGIMA019E The value entered for Escalation
Time is not valid. The value must be an
integer equal to or greater than 1.
Explanation: The value for the Escalation Time is not
correct. The value must be one or more days.
CTGIMA015E To Do Reminder configuration data
for the organization_name organization
cannot be stored.
Administrator response: Change the value for the
Escalation Time field.
Explanation: To Do reminder configuration data that
was specified on the Workflow Notifications page
cannot be saved into the LDAP database.
CTGIMA020E The interval value is not valid. The
value for the Reminder Interval field
must be an integer.
Administrator response: Verify that the LDAP server
is available and that there are no network outages, and
then try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Explanation: The value for the Reminder Interval field
is not correct. The value must be an integer.
A configuration error occurred for the To Do reminder
component. An attempt to retrieve the configuration
data from the LDAP database failed. A message is
written to the log file.
CTGIMA017E An expected To-Do Reminder
notification message was not sent.
Explanation: The To-Do Reminder workflow
notification is enabled, and an unexpected error
occurred, and the request to send a to-do reminder was
not scheduled.
Administrator response: Verify the template syntax is
correct. A syntax coding error of dynamic content can
cause this problem. Review the IBM Security Privileged
Identity Manager log files for additional information.
Look for data indicating a problem with notification
e-mail messages. Check that the Java Message Service
(JMS) queue and directory server are available.
An error occurred when the To Do workflow
notification component detected that a reminder
message was not scheduled as expected. Review the
scheduler code for problems. A message is written to
the log file.
CTGIMA018E The Key tag and the key attribute on
the RE tag cannot be specified at the
same time.
Explanation: Coding the Key tag and the key attribute
on the RE tag is not allowed within the same RE tag
coding. Both the Key tag and key attribute provide the
same information.
Administrator response: Remove either the key
attribute from the RE tag or the Key tag statement from
the activity. Start the workflow again.
A parsing error occurred on the work order element of
the to-do reminder component with dynamic content. A
message is written to the log file.
Administrator response: Change the value for the
Reminder Interval field.
This is a configuration error, the administrator needs to
enter a valid time in the reminder interval field.
CTGIMA021W The property property_name cannot
be read from the enRole.properties file.
The default refresh period of 10 minutes
will be used.
Explanation: The property for determining how often
to refresh the reminder cache could no successfully be
read from the properties file. The default of 10 minutes
will be used.
Administrator response: If you wish to use something
other than 10 minutes as the cache refresh time, edit
the enRole.properties file on the IBM Security
Privileged Identity Manager server, and add the key
listed above with a value (in minutes). Then, stop and
start application server.
CTGIMA022E An error occurred retrieving the
Reminder configuration data.
Explanation: Configuration data specified on the
Reminder page cannot be retrieved from the directory
server.
Administrator response: Verify that the directory
server is available and there are no network outages
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An attempt to retrieve the configuration data from the
LDAP database for the reminder component failed. A
message is written to the log file.
CTGIMA023E A directory server communication
error occurred while trying to retrieve
Reminder configuration data.
Explanation: An communication error occurred while
Messages
3
CTGIMA024E • CTGIMA104W
trying to contact the directory server.
Administrator response: Check to make sure the
directory server is up and running.
An attempt to retrieve the configuration data from the
directory server database for the reminder component
failed. A message is written to the log file. Most likely
the directory server can not be contacted.
CTGIMA024E The field_name field contains a
template validation error. The following
error occurred. Error: error_text
Explanation: When saving the notification template,
each field is validated. A syntax error occurred in the
identified field.
Administrator response: Correct the notification
template.
This is a configuration error, the administrator needs to
enter valid notification template.
CTGIMA025E The following error occurred while
executing ITIMURL tag. Error: error_text
Explanation: An error occurred while executing
ITIMURL tag.
Administrator response: An error occurred while
executing ITIMURL tag. A message is written to the log
file.
An error occurred while executing ITIMURL tag. A
message is written to the log file.
CTGIMA101E The Java Message Service (JMS)
resources cannot be found in order to
send a message to the queue_name
destination queue. The following error
occurred. Error: error_text
Explanation: An error occurred while locating the Java
Message Service (JMS) resources that are required to
send a JMS message to the specified destination queue.
Either the JMS Queue Connection Factory or queue
could not be located through JNDI. Processing cannot
continue.
Administrator response: Review the status of the JMS
servers that are hosting the queues in your application
server environment. The JMS servers must be in the
running state. If they are currently stopped, start them.
If the JMS servers are running, review the application
server log files for errors. If the problem persists, check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman..
In addition to the administrator actions, review the
queue, queue connection factory, and the
enRole.properties file for errors.
CTGIMA102E A Java Message Service (JMS) error
occurred while putting a message on the
queue_name JMS queue. The following
error occurred. Exception: exception_text
Explanation: An error occurred while putting a
message on the specified JMS queue. Processing cannot
continue.
Administrator response: Review the status of the JMS
servers that are hosting the queues in your application
server environment. The JMS servers must be in the
running state. If they are currently stopped, start them.
If the JMS servers are running, review the application
server log files for errors. If the problem persists, check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
configuration for errors.
CTGIMA103W An error occurred while putting a
message on the queue_name Java
Message Service (JMS) destination
queue. The message will be put on the
backup_queue_name backup destination
queue. The following error occurred.
Exception: exception_text
Explanation: An error occurred while putting a
message on a Java Message Service (JMS) message
queue. The message will be sent to the specified
backup queue. This message occurs when a queue is
not available at the time the message is being sent to
the queue. The outage might be temporary.
Administrator response: Review the status of the JMS
servers that are hosting the queues in your application
server environment. The JMS servers must be in the
running state. If they are currently stopped, start them.
If the JMS servers are running, review the application
server log files for errors. If the problem persists, Check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
configuration for errors.
CTGIMA104W The Java Message Service (JMS)
could not be closed after putting a
message on the queue_name destination
queue. The following error occurred.
Error: error_text
Explanation: An error occurred while closing the Java
Message Service (JMS) queue. The close process occurs
after successfully putting a message on the queue.
Administrator response: Review the status of the JMS
4
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA105W • CTGIMA109W
servers that are hosting the queues in your application
server environment. The JMS servers must be in the
running state. If they are currently stopped, start them.
If the JMS servers are running, review the application
server log files for errors. If the problem persists, check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
configuration for errors.
CTGIMA105W The value for the Java Message
Service (JMS) message expiration
interval cannot be loaded from the
properties files. The default value of 24
hours was used. The following error
occurred. Exception: exception_text
Explanation: The message expiration interval could
not be read from the enRole.properties file. This value
controls the maximum life of a Java Message Service
(JMS) message. The default value of 24 hours was used
instead.
Administrator response: Review the classpath variable
for this application server to ensure that the
enRole.properties file can be located properly. Ensure
that the file exists, and that you have correct file
permissions. Verify that the property
enrole.messaging.ttl is set to an appropriate value.
CTGIMA106E While removing a Java Message
Service (JMS) message, the
message-driven bean queue name could
not be located. The following error
occurred. Exception: exception_text
Explanation: The message-driven beans load their
queue names based on the configuration information in
the deployment descriptors of the application. The
queue name could not be located.
Administrator response: Ensure that the application
has been deployed correctly to the application server.
Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The queue name is set as an environment entry for
each message-driven bean. This configuration is set in
the deployment descriptors for the application. If this
configuration is still correct, then this is likely a
problem with the application server itself.
CTGIMA107E An unexpected error occurred while
processing the Java Message Service
(JMS) message_id message on the
queue_name queue. The message will be
discarded. The following error occurred.
Exception: exception_text
Explanation: A Java Message Service (JMS) message
that was delivered to the application could not be
processed correctly. The message will be discarded.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is issued whenever an error occurs while
processing a message from a non-transacted queue.
This might or might not be an error in the messaging
component itself. Because non-transacted queues do not
retry message processing, the message has been
discarded. The IBM Security Privileged Identity
Manager log files should contain additional information
regarding the root cause of the problem.
CTGIMA108E An unexpected error occurred while
processing the message_id Java Message
Service (JMS) message on the
queue_name queue. The message will be
delivered again and potentially
rescheduled or retried. The following
error occurred. Exception: exception_text
Explanation: A Java Message Service (JMS) message
that was delivered to the application could not be
processed correctly. The transaction will be rolled back,
and the message will be delivered again. At that time,
message processing will potentially be immediately
retried or scheduled for future processing.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is issued whenever there is an error while
processing a message from a transacted queue. This
might or might not be an error in the messaging
component itself. Transacted queues will retry or
reschedule messages up to the configured time limits.
The IBM Security Privileged Identity Manager log files
should contain additional information regarding the
root cause of the problem.
CTGIMA109W Attempting an immediate retry for
the Java Message Service (JMS)
message_id message on the queue_name
queue.
Explanation: An error occurred while sending a Java
Message Service (JMS) message to the required
destination.
Administrator response: Review the IBM Security
Messages
5
CTGIMA110W • CTGIMA114W
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
file for errors.
CTGIMA110W Scheduling a retry for the message_id
Java Message Service (JMS) message on
the queue_name queue. The message has
been delivered num_retries times, and
will be rescheduled for delivery in
approximately retry_delay milliseconds.
Explanation: An error occurred sending a Java
Message Service (JMS) message to the required
destination during an additional attempt. Message
CTGIMA111W is displayed when an error occurs on
the initial attempt to deliver the message. The number
of retries is specified in the enRole.properties file.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
configuration for errors.
CTGIMA111E Discarding message message_id, which
was received on queue queue_name. The
message has been delivered num_retries
times, and has not been successfully
handled after retry_delay milliseconds.
Explanation: An error occurred while sending a Java
Message Service (JMS) message to the required
destination.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
configuration for errors.
6
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA112E Cannot register a listener for
handling the message completion
events. The following error occurred.
Error: error_text
Explanation: An attempt to install a fix pack caused
an error. The fix pack is not one expected by the IBM
Security Privileged Identity Manager server.
Administrator response: Restart the application server
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman
In addition to the administrator actions, review the
queue, queue connection factory, and enRole.properties
configuration for errors.
CTGIMA113W The Java Message Service (JMS)
queue configuration attribute
attribute_name for queue queue_name is
not supported. The value will be
ignored.
Explanation: A configuration attribute for the
specified queue was found in the enRole.properties file,
but it is not supported. The setting will be ignored.
Administrator response: Review the enRole.properties
file for Java Message Service (JMS) configuration
problems. Verify that the configuration parameters are
set correctly.
CTGIMA114W A Java Message Service (JMS)
message message_id was redelivered on
the queue_name queue. Retries are not
supported on this queue. The message
is discarded.
Explanation: Some IBM Security Privileged Identity
Manager Java Message Service (JMS) queues do not
handle redelivered messages. Messages attempted to be
redelivered to these queues are discarded.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the redelivery. It may be due to
an application server restart. Try the operation again.
This message is issued when a JMS message is
redelivered on a non-transacted queue. These queues
intentionally do not expect redeliveries, and do not
handle retry. This warning is likely do to some
non-application problem during the message's original
delivery. For example, if the application server is
restarted during the message's first delivery attempt, a
redelivery may occur.
CTGIMA150E • CTGIMA220W
Privileged Identity Manager log files for additional
information about the error.
CTGIMA150E The partitioning operation cannot
locate the state information for the
partition_identifier partitioning sequence.
A requested operation might not
complete successfully.
CTGIMA200W The work_item_id activity is not
found.
Explanation: The in-memory state information for a
partitioning sequence cannot be located. This is most
likely due to an application server process being
restarted during the partitioning process.
Explanation: The activity requested does not exist.
This condition can happen under normal processing
such as when two people are working on the list at
same time.
Administrator response: Try the operation again. If
the problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
Administrator response: Refresh the list and then try
the operation again. If the problem persists, review the
IBM Security Privileged Identity Manager log files for
associated errors.
CTGIMA152W A step in the partition_identifier
partitioning sequence is being processed
again because an exception occurred
while processing the data set.
Explanation: An error occurred while partitioning the
data set.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA153W A step in the partition_identifier
partitioning sequence is being tried
again because an unexpected exception
occurred while handling the step.
Explanation: An error occurred while partitioning the
data set during.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA154E A step in the partition_identifier
partitioning sequence failed because an
unexpected exception occurred while
processing the data set.
Explanation: An error occurred while partitioning the
data set.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA155E A step in the partition_identifier
partitioning sequence failed because an
unexpected error occurred while
partitioning the data set.
Explanation: An error occurred while handling the
data set during partitioning.
Administrator response: Review the IBM Security
CTGIMA201W The database that contains the
activities is not currently available.
Explanation: The IBM Security Privileged Identity
Manager database that contains the workflow activities
cannot be found.
Administrator response: Ensure that the IBM Security
Privileged Identity Manager database is available and
that there are no network outages, and then try the
operation again. Review the IBM Security Privileged
Identity Manager log files for additional information
about the root cause of the problem. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An error occurred retrieving data from the IBM
Security Privileged Identity Manager database while
processing an activity. Check the work item table to
ensure that the activity exists. A message is written to
the log file.
CTGIMA202E An error occurred while retrieving
the owner list for the work_item_id
activity.
Explanation: An error occurred retrieving the list of
activity owners while attempting to forward a request
from the to-do list to someone else. The list of potential
activity owners is empty.
Programmer response:
CTGIMA220W The work_item_id activity cannot be
locked. The activity is locked is locked
by another user.
Explanation: The operation cannot complete because
another user has the activity locked.
Administrator response: After the item is unlocked,
try the operation again.
An error occurred while accessing a locked work item
for the activity management component. A message is
written to the log file.
Messages
7
CTGIMA221E • CTGIMA243E
CTGIMA221E The work_item_id activity cannot be
unlocked without the proper
authorization. You must be the activity
owner or the system administrator to
unlock the activity.
Explanation: The operation cannot complete because
the user ID that is used to unlock the activity does not
have the appropriate authority. The activity will not be
unlocked.
Administrator response: Log on as an administrator
or with the activity owner account, and try the
operation again.
An error occurred while accessing an activity for the
work item management component. A message is
written to the log file.
CTGIMA222E The work_item_id activity cannot be
forward because it is locked by another
user.
another user owns the activity. The activity is locked.
Administrator response: Wait until the activity is
unlocked and try the operation again.
An error occurred while completing a locked activity
for the activity management component. A message is
written to the log file.
CTGIMA240E The work_item_id activity cannot be
deferred. You must be the owner to
defer an activity.
Explanation: The operation cannot complete because
the user ID used to defer the activity does not have the
appropriate authority. The activity will not be deferred.
Administrator response: Log on as an administrator
or with the activity owner account, and try the
operation again.
Programmer response: Verify that the program that
contains the call to defer a activity includes the proper
authority or is accessing the correct activities.
Explanation: The operation cannot complete because
the user ID used to forward the activity does not have
the activity locked. The activity is locked by another
user.
An error occurred while deferring a work item for the
work item management component. A message is
written to the log file.
Administrator response: Contact the system
administrator or the lock owner to remove the lock,
and try the operation again.
CTGIMA242E The work_item_id activity. The activity
does not allow deferral.
Programmer response: Verify that the program that
contains the call to forward an activity includes the
proper authority or is accessing the correct activities.
An error occurred while unlocking a work item for the
work item management component. A message is
written to the log file.
CTGIMA223E The work_item_id activity cannot be
forwarded to a user who is not
identified as a potential assignee for the
activity.
Explanation: An activity cannot be assigned to
someone not listed in the initial assignment list.
Administrator response: Select a participant from the
owner list, and try the operation again.
Programmer response: Verify that the program
containing the call to forward a activity includes the
proper authority or is accessing the correct activities.
An error occurred while accessing a work item for the
work item management component. A message is
written to the log file.
CTGIMA230E The work_item_id activity cannot be
completed. The activity is locked by
another user.
Explanation: The operation cannot complete because
8
IBM Security Privileged Identity Manager: Error Message Guide
Explanation: Deferral of this to-do list item is not
supported.
Programmer response: Verify that the program
deferring activities includes checking for to-do list
items that can be deferred.
An error occurred while deferring a work item for the
work item management component. A message is
written to the log file.
CTGIMA243E The work_item_id to-do list item
cannot be deferred, because an internal
error occurred.
Explanation: The deferral operation cannot complete
because an internal error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Programmer response: Verify that the program that
contains the call to defer an activity is accessing the
correct work items.
An error occurred while deferring n activity for the
work item management component. Check the trace
log (DEBUG_MIN) for specific information on why the
deferral failed.
CTGIMA244E • CTGIMA407E
CTGIMA244E The work_item_id to-do list item
cannot be deferred. The item is locked
by another user.
Explanation: The deferral operation cannot complete
because the activity is locked by another user.
Administrator response: Wait until the activity is
unlocked and try the operation again.
An error occurred while deferring an activity for the
work item management component. A message is
written to the log file.
CTGIMA401E An unhandled error occurred in the
process_id process for the activity_id
activity. The root process ID is
root_process_id. You may have to
manually abort the process. The
following error occurred. Error: error_text
Cause: root_cause
CTGIMA404E person_name person failed the service
selection policy evaluation.
Explanation: The service selection policy evaluation
failed for the specified person. The person did not meet
the requirements specified by the policy.
Administrator response: Ensure that the service
selection policy is valid for the specified person. Ensure
that there are no syntax errors in the policy. Review the
IBM Security Privileged Identity Manager log files for
additional information about the error.
CTGIMA405E At least one of the activities in the
workflow process failed or had
warnings.
Explanation: Activities can fail during a workflow
process for numerous reasons. Review the workflow
audit trail, for additional information about the
problem.
Explanation: An earlier error occurred that was not
reported. The error has been detected during a later
processing and is impacting this processing. An attempt
to recover from the error and continue with processing
was unsuccessful.
Administrator response: Check the activities and
subprocesses for the workflow for coding problems.
From the IBM Security Privileged Identity Manager
user interface, review the workflow audit trail for
additional information.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Look for errors that
occurred before the one specified in the message.
CTGIMA406W The workflow_process_id workflow
process cannot continue because it is
already completed.
CTGIMA402E The context_factory_name value for the
enrole.appServer.contextFactory property
in the enRole.properties file is not
supported.
Explanation: The value specified for the
enrole.appServer.contextFactory property is not an
expected value.
Administrator response: Edit the enRole.properties
file and change the Context Factory property to a valid
value.
CTGIMA403E An error occurred while reading the
enrole.appServer.contextFactory property
value in the enRole.properties file.
Explanation: An error occurred trying to read the data
for the enrole.appServer.contextFactory property.
Administrator response: Ensure that the file and
property exist. Review the IBM Security Privileged
Identity Manager log files for additional information
about the error.
Explanation: An attempt to continue a workflow
process cannot be done because the work flow has
already completed. This message might be the result of
timing.
Administrator response: From the IBM Security
Privileged Identity Manager user interface, review the
workflow audit trail to ensure that the workflow
process completed normally. Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMA407E A configured workflow activity
expected to receive
expected_parameter_size parameters, but
received_parameter_size parameters were
received for workflow_name workflow
that was processing the activity_name
activity.
Explanation: The activity received parameter
information that did not match what was configured
for the parameters. The activity had been defined to
expect a number of parameters based on a
configuration value. The number of parameters that
were received did not match the value defined.
Administrator response: Ensure that the specified
workflow activity is coded correctly in the workflow
designer.
Messages
9
CTGIMA408E • CTGIMA415E
CTGIMA408E The parameter definition for the
activity_defn_id activity contains an error.
CTGIMA412E The following process already exists.
Process ID: process_id
Explanation: The parameter definition did not contain
a valid relevant data ID. Processing of the activity is
stopped.
Explanation: An internal processing error occurred
causing an internal random generated identifier to be
generated again. Another attempt to generate the
identifier will be performed.
Administrator response: Review the process definition
for an activity parameter this is not correct. Add the
correct relevant data ID.
CTGIMA409E The work_item_id workflow definition
is not valid. The Start element is
missing.
Explanation: The Start element, which defines the
beginning of a workflow, is a required element. If you
use the IBM Security Identity Manager workflow
designer, this error should not occur because the
interface automatically creates the Start element for any
workflow process that you create.
Administrator response: Review the workflow
definition for any errors. If the problem persists, check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Gather the workflow XML definition. Review the XML
for any syntax errors. It is possible that the XML has
been modified.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
CTGIMA413E The following activity already exists.
Activity ID: activity_id
Explanation: An internal processing error occurred
causing an internal random generated identifier to be
generated again. Another attempt to generate the
identifier will be performed.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMA410E The data_type_id data type within the
work_item_id workflow definition is not
found.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
Explanation: A data type reference by the Relevant
data for a workflow process cannot be located. This is
an IBM Security Identity Manager internal processing
error.
CTGIMA414E The following activity already exists.
Activity: work_item_id
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman
The Java class is missing.
Explanation: An internal processing error occurred
causing an internal random generated identifier to be
generated again. Another attempt to generate the
identifier will be performed.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMA411E The method_name workflow extension
method in the class_name class cannot be
processed.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
Explanation: The method in the workflow extension
cannot be found.
CTGIMA415E The data_id data item for the
process_id process already exists.
Administrator response: Review the workflow
definitions for the extension. Ensure that the class and
method parameter list that is specified in the extension
and any custom Java classes are in the CLASSPATH.
Explanation: An internal processing error occurred
causing an internal random generated identifier to be
generated again. Another attempt to generate the
identifier will be performed.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
10
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA416E • CTGIMA422E
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
CTGIMA416E The following process cannot be
found in the database. Process ID:
process_id
Explanation: A random identifier created by the
workflow process cannot be located. An internal
processing error occurred causing the identifier to be
deleted or not saved into the database. Another attempt
to locate the identifier will be performed. Normal
processing will continue if the identifier is found on
subsequent attempts.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
CTGIMA417E The following activity cannot be
found in the database. Activity ID:
activity_id
Explanation: A random identifier created by the
workflow process cannot be located. An internal
processing error occurred causing the identifier to be
deleted or not saved into the database. Another attempt
to locate the identifier will be performed. Normal
processing will continue if the identifier is found on
subsequent attempts.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
CTGIMA418E The following activity cannot be
found in the database. Activity ID:
work_item_id
Explanation: A random identifier created by the
workflow process cannot be located. An internal
processing error occurred causing the identifier to be
deleted or not saved into the database. Another attempt
to locate the identifier will be performed. Normal
processing will continue if the identifier is found on
subsequent attempts.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
CTGIMA419E The data_id data item for the
process_id process cannot be found in the
database.
Explanation: A random identifier created by the
workflow process cannot be located. An internal
processing error occurred causing the identifier to be
deleted or not saved into the database. Another attempt
to locate the identifier will be performed. Normal
processing will continue if the identifier is found on
subsequent attempts.
Administrator response: Review the workflow audit
trail for other errors that may have preceded this
message. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Review the workflow component code generating
random identifiers. Check the log files for other errors.
CTGIMA420E Expected the
ActivityDefinitionOperation class but
found the definition_class class.
Explanation: The expected operation definition class
passed to the operation does not extend
ActivityDefinitionOperation class. This activity will fail.
Administrator response: This is an internal error.
Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMA421E An error occurred while processing
an operation. The entity profile for the
operation cannot be resolved. The result
of evaluating the entity_type entity for
the entity_exp expression is null.
Explanation: The value for the Entity or the
Expression fields contains an error.
Programmer response: Locate the workflow definition
and correct the operation node definition.
CTGIMA422E The target entity is null for the
operation_name operation.
Explanation: The Relevant Data field value associated
with the operation is null or the expression provided in
the Expression field is null. These fields are located on
Messages
11
CTGIMA423E • CTGIMA431W
the Properties: Operation Node page.
error in the activity definition.
Programmer response: Review the customized
workflow definition and make certain there is an Entity
listed in the relevant data.
Administrator response: Review the activity definition
created in the workflow designer for coding errors. You
can also increase the number of attempts by updating
the enrole.workflow.maxretry property in the
enRole.properties file.
CTGIMA423E The data_type data type for the
operation_name operation is not valid.
Explanation: An operation that requires an Entity, as
input data, is being called without a valid Entity. The
system cannot continue without the proper relevant
data. Only account and person data types are expected.
CTGIMA428E The process_id process has stopped.
Error: error_text
Explanation: The process has been terminated because
of a failure during the execution of the workflow.
Programmer response: Review the customized
workflow definition and make certain the correct type
of Entity is listed in the relevant data or returned by
the associated expression. Review the Expression field.
Administrator response: Examine the reason for clues
to the problem with the workflow. Review the IBM
Security Privileged Identity Manager log files for
additional information about the error.
CTGIMA424E The operation_type operation is not
valid.
CTGIMA429W A message has been received for the
activity_id activity, which has already
completed processing.
Explanation: The operation type for the workflow is
not valid. It must be either Static or Non Static.
Programmer response: Review the workflow
definition to ensure that the type is Static or Non Static.
CTGIMA425E The workflow process cannot be
started because a sub process definition
identifier cannot be found.
Explanation: The process definition for a sub process
could not be located. The execution of the activity has
been halted. This is likely an issue with a custom
workflow in which an operation defined in it no longer
exists in the system.
Administrator response: Check the workflow
definition to make certain all components of the
workflow exists in the system.
CTGIMA426E There are no valid transitions that
can be found for the activity. The
workflow processing is stopped.
Explanation: There are no valid transitions found for
the workflow. For example, if a warning result code is
received for an activity and there are transitions for
success and failure, this message is issued. The
workflow processing is ended and the results are
unpredictable.
Administrator response: Open the workflow
definition and make certain that there are transitions
from activities for all conditions.
Explanation: A request to process the activity was
made after the activity had completed. This message
occurs when a process or activity has been stopped
intentionally and does not indicate a problem.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA430W A log entry in database cannot be
created for auditing the process_id
process.
Explanation: An error occurred creating an audit
record in the database for the process. The process will
continue, but an audit log is not created. The error
might be an intermittent database problem.
Administrator response: Verify that the connection to
the database server is available.
CTGIMA431W The activity identifier is already
started for the following process. The
request to restart the process is ignored.
Process: process_id Activity: activity_id
Explanation: A request to start an activity that is
already started occurred. The system recognized that
the activity is already running and continue normal
operation.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA427E The activity with the activity_design_id
design ID exceeds the workflow retry
count and is ended.
Explanation: The maximum number of retries has
been attempted. This may be the result of a coding
12
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA432W • CTGIMA441E
CTGIMA432W An error occurred while processing
an activity. The activity will be
processed again. The current retry count
is current_retry_count out of
max_retry_count. Activity: activity_id
Process: process_id
Explanation: An error occurred during processing
while processing an activity. The activity will be started
again. This message can occur as normal processing.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA433W An processing for the process_id
process with root_process_id root process
ID for the activity_id is interrupted.
Privileged Identity Manager log files for additional
information about the error.
CTGIMA436E An assertion failure occurred in the
process_id process for activity_id activity
and root_process_id root process. You
might need to manually end the process.
The following error occurred. Exception:
exception_text Cause: root_cause
Explanation: An earlier error occurred that was not
reported. The error has been detected during a later
processing and is impacting this processing. The error
is probably a system error that caused the workflow
processing to retry the operation processing when
detected. An attempt to recover from the error and
continue with processing was unsuccessful.
Explanation: The root process detected a sub process
that has been aborted.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Also, review the completed
request information for the process.
CTGIMA438W An audit cannot be completed on
the activity_id activity. The audit activity
data contains a null name.
CTGIMA434E A missing entity exception occurred
in the process_id process for the
activity_id activity and root_process_id root
process. You might need to manually
end the process. The following error
occurred. Exception: exception_text Cause:
root_cause
Explanation: An earlier error occurred that was not
reported. The error has been detected during a later
processing and is impacting this processing. The error
is probably a system error that caused the workflow
processing to retry the operation processing when
detected. An attempt to recover from the error and
continue with processing was unsuccessful.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA435E An entity service error occurred in
the process_id process for the activity_id
activity and root_process_id root process.
You might need to manually end the
process. The following error occurred.
Exception: exception_text Cause: root_cause
Explanation: An earlier error occurred that was not
reported. The error has been detected during a later
processing and is impacting this processing. The error
is probably a system error that caused the workflow
processing to retry the operation processing when
detected. An attempt to recover from the error and
continue with processing was unsuccessful.
Administrator response: Review the IBM Security
Explanation: The data to be audited is missing a valid
ID or name.
Administrator response: Review the workflow design,
which contains the specified activity ID. Ensure that the
relevant data definitions contain IDs and names.
This message is not expected in production
environments. If this message is logged verify the
workflow definition associated with the activity to
make sure it has a correct definition.
CTGIMA440E The activity_name activity for the
workflow_name workflow could not be
saved because it is locked by
lock_owner_name.
Explanation: A workflow activity can only be saved if
it is not locked, or if it is locked by the user attempting
to save the workflow activity.
Administrator response: Contact the system
administrator or the lock owner to remove the lock,
and try the operation again.
CTGIMA441E The activity_name activity for the
workflow_name workflow could not be
saved because it expects
expected_parameter_size workflow
parameters, but received_parameter_size
workflow parameters were specified.
Explanation: An incorrect number of workflow
parameters were specified while saving the workflow
activity. The activity is defined to expect a number of
workflow parameters based on a configuration value.
The number of workflow parameters that were
Messages
13
CTGIMA442E • CTGIMA506E
specified did not match the value defined.
Administrator response: Ensure that the correct
number of workflow parameters are specified when
saving the activity.
CTGIMA442E The activity_name activity for the
workflow_name workflow could not be
saved because it expects the
parameter_name parameter to be of type
expected_type, but a value of type
received_type was specified.
Explanation: An incorrect type for the specified
workflow parameter was provided while saving the
workflow activity. The activity is defined to expect a
type of parameter based on a configuration value. The
type of workflow parameter that was specified did not
match the type defined.
Administrator response: Ensure that the correct
workflow parameter types are specified when saving
the activity.
CTGIMA460E A process definition cannot be
created for a Compliance Alert because
the definition is not valid.
Explanation: The Compliance Alert process definition
cannot be created based on the provided input.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA461E The Compliance Alert process
definition cannot be parsed because it is
not valid.
Explanation: The system was unable to parse the
process definition representing the Compliance Alert
activity. There is an error in the process definition as
stored in the directory.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA462E
The callback_id callback already exists.
Explanation: An internal processing error occurred
causing an internal random generated identifier to be
generated again.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
14
CTGIMA500E The user is not an owner of the
work_item to-do list item.
Explanation: To process a to-do list item a user must
be an owner of the to-do list item. The activity
assignment is determined when the to-do list item is
defined in the system.
Administrator response: Insure that the user is an
owner of the to-do list item.
CTGIMA502E The activity_id activity cannot be
found.
Explanation: There is a problem in the system
retrieving the activity for the given identifier. This
problem can also occur if the given identifier is not
valid.
Administrator response: Make sure the activity is
defined in the system and try the operation again. If
the problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMA503E The process_id process cannot be
found.
Explanation: While retrieving the process from the
system a problem occurred.
Administrator response: Try the operation again. If
the problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMA504E The user_name user is not authorized
to retrieve the process_id process.
Explanation: The user is not authorized to perform
this action. Contact the system administrator.
Administrator response: Make sure the user is
authorized to perform the action.
CTGIMA505E Select either Submitted By or
Submitted For to continue the search.
CTGIMA506E The to-do list items cannot be
forwarded as a group. Each one must be
forward individually.
Explanation: Only to-do list items having the same
owner group can be forwarded in a group.
Administrator response: Forward each item
separately.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA507E • CTGIMA605E
CTGIMA507E There is no user select to send the
to-do list item.
Explanation: The to-do list item cannot be forward
because no users have been selected to send the item.
Administrator response: Select a user to forward the
to-do list item.
CTGIMA508E The to-do list item cannot be
forwarded. It does not contain a person
to forward the item.
Explanation: The to-do list item cannot be forward
because it does not have any owners associated with it.
Administrator response: Assign an owner to the item
before forwarding it.
CTGIMA510E An assignment did not save because
it is not a packaged approval
assignment.
Explanation: An attempt to save an assignment did
not complete because it is not a packaged approval
assignment. Saving is only supported for packaged
approval assignments.
Administrator response: Ensure that saving is only
attempted for packaged approval assignments.
CTGIMA511E The impact for an assignment could
not be assessed because the assignment
is not a packaged approval assignment.
Explanation: An attempt was made to determine the
impact an assignment would have upon completion.
The determination could not be made because the
assignment is not a packaged approval assignment.
Determining the impact of an assignment upon
completion is only supported for packaged approval
assignments.
Administrator response: Ensure that determining the
impact is only attempted for packaged approval
assignments.
CTGIMA512E An assignment did not save because
the specified assignment parameters do
not match, or are not a subset of, the
parameters defined for the assignment.
Explanation: The assignment parameters that were
specified while attempting to save an assignment did
not match those defined for the assignment. When
saving an assignment, the number of assignment
parameters and type of each must match the
assignment parameters defined for the assignment.
Additionally, if a packaged approval document
parameter is specified, its contents must be the same,
or a subset of, the contents of the input packaged
approval document parameter received by the
assignment.
Administrator response: Ensure that assignment
parameters match those defined for the assignment.
CTGIMA513E The impact for an assignment could
not be determined because the specified
assignment parameters do not match, or
are not a subset of, the parameters
defined for the assignment.
Explanation: The assignment parameters that were
specified while attempting to determine the impact for
an assignment did not match those defined for the
assignment. When determining the impact for an
assignment upon completion, the number of
assignment parameters and type of each must match
the assignment parameters defined for the assignment.
Additionally, if a packaged approval document
parameter is specified, its contents must be the same,
or a subset of, the contents of the input packaged
approval document parameters received by the
assignment.
Administrator response: Ensure that assignment
parameters match those defined for the assignment.
CTGIMA514E The group group_value could not be
found during user recertification impact
analysis for account account_name.
Explanation: The specified group cannot be found in
the directory server. The group might have been
removed by another user or operation while the impact
was being determined. Retry the operation.
Administrator response: If the problem persists, check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMA600E The account cannot be created
because one or more prerequisite is
missing for the service_name service.
Explanation: The account cannot be created for the
service because a prerequisite account is missing.
Administrator response: Check the service instance
for the prerequisite. Create the prerequisite account
before trying this operation again.
This message is to show that creation of new account
failed because the prerequisite account/s defined in
service instance could not be found. Check the service
instance for the prerequisite. Create the prerequisite
account/s before trying this operation again.
CTGIMA605E The role membership changes cannot
be applied.
Explanation: An attempt to assign a dynamic role to a
person failed. It could be due to various backend
processes failed during calculation of dynamic role.
Messages
15
CTGIMA609E • CTGIMA615E
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
An attempt to assign dynamic role to a person fails. It
could be due to various backend processes failed and
system error during calculation of dynamic role. It is
important to capture trace.log and msg.log to
determine the cause of failure.
CTGIMA609E An error occurred getting the person
preferred password for the following
services: service_list
Explanation: Occurs only when the Synchronize
Password feature is turned on. During auto
provisioning, there was an error getting the user's
preferred password.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the problem. It could be due to
problem in generating new password across those
different services or data services error when getting
the persons preferred password.
Review the log files for abnormality in system log on
dataservices and Policy component.
CTGIMA610E An error occurred while retrieving
the person preferred password for the
service_list service. There are no accounts
to synchronize.
Explanation: Occurs only when the Synchronize
Password feature is turned on. During auto
provisioning, the persons preferred password does not
satisfy the list of ordered provisioning.
Administrator response: Make sure user has a
preferred password that satisfies all his entitled
services.
CTGIMA611E An error occurred while evaluating
account compliance for the following
account. Account ID: account_uid Service:
service Person: person Message:
message_text
Explanation: Some errors occurred during policy
evaluation to determine existing account's compliance
state or to determine provisioning parameter values for
new accounts.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA612E The activity cannot be found while
processing a compliance alert for the
activity. The process result has been set
to warning. Activity: activity_id
Explanation: An error occurred while processing a
compliance issue for the account. The activity
referenced by the activity identifier cannot be found.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA613E There was a problem encountered
while working with compliance alerts
for this account. The process result has
been set to WARNING.
Explanation: An error occurred while processing a
compliance issue for the given account. See the trace
log for more information on the exact cause of the
failure.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA614E The account cannot be restore
because one or more prerequisite is
inactive for the service_name service.
Explanation: An attempt to restore an account on a
service failed because a prerequisite account is inactive.
Administrator response: This happens when the
workflow operation for restore account has been
modified to use restoreAccountCheckPreReq. Check the
service instance for the prerequisite. Restore the
prerequisite account before trying this operation again.
This message is to show that restoration of account
failed because the prerequisite account/s defined in
service instance is inactive. Check the service instance
for the prerequisite. Restore the prerequisite account/s
before trying this operation again.
CTGIMA615E A prerequisite account cannot be
suspended. There are dependant
accounts on service_name service.
Explanation: An attempt to suspend an account on a
service that is a prerequisite for existing accounts on
the specified service. All the dependant accounts must
be suspended before a prerequisite account can be
suspended.
Administrator response: This happens when the
workflow operation for suspend account has been
modified to use suspendAccountCheckPreReq. All the
dependant accounts must be suspended before a
prerequiste account can be suspended. Dependency
(prerequisite) is defined at the Manage Service screen.
This message is to show that suspension of account
16
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA616E • CTGIMA623E
was disallowed because it has other dependant active
account(s).
account to be fixed and made to be compliant so that
account can be created successfully.
CTGIMA616E Invalid data input to a workflow
activity.
CTGIMA619W There are no recertification targets
for user_name under the scope of this
recertification policy.
Explanation: Invalid or unexpected data is passed into
a workflow activity like a workflow extension. For
example, an unexpected NULL value or unexpected
empty String.
Administrator response: This happens when data is
corrupted due to other failures in the system or caused
by programmatic errors. The programmatic error may
be caused by system defect or errors introduced in
system customization.
System trace log is required to trouble shoot the
problem and find out the root cause of the failure.
CTGIMA617E The account account_uid cannot be
created either because the account is
disallowed for the user or one or more
attributes are not compliant with
provisioning policy.
Explanation: The account cannot be created because it
is either disallowed or non-compliant.
Administrator response: This happens when the
service enforcement is set to Alert but alert notification
is disabled for account change. Enable the Alert for
account change in the service enforcement
configuration will allow the account to be fixed and
made to be compliant so that account can be created
successfully.
This happens when the service enforcement is set to
Alert but alert notification is disabled for account
change. Enable the Alert for account change in the
service enforcement configuration will allow the
account to be fixed and made to be compliant so that
account can be created successfully.
CTGIMA618E The account account_uid cannot be
modified because one or more attributes
are not compliant with provisioning
policy.
Explanation: The account cannot be modified because
it is non-compliant.
Administrator response: This happens when the
service enforcement is set to Alert but alert notification
is disabled for account change. Enable the Alert for
account change in the service enforcement
configuration will allow the account to be fixed and
made to be compliant so that account can be created
successfully.
Explanation: The specified user does not have any
recertification targets under the scope of the
recertification policy being processed. For example, the
user might only have automatically provisioned
accounts or mandatory groups that match the scope of
the policy. In this case, the recertification is skipped for
the specified user.
CTGIMA620E One or more required fields
required_fields are either missing or
invalid.
Explanation: One or more required fields are either
missing or invalid. The CSV entry can not be
processed.
Administrator response: Provide correct values for the
required fields.
CTGIMA621E Number of fields in the entry does
not match the number of fields present
in the header.
Explanation: Number of fields in the entry does not
match the number of fields present in the header. The
CSV entry can not be processed.
Administrator response: Verify fields in entry against
those present in the header.
CTGIMA622E The underlying account account_uid
does not exist on the specified service.
Explanation: The underlying account does not exist on
the specified service. The CSV entry can not be
processed.
Administrator response: Specify a valid underlying
account.
CTGIMA623E No valid owner is specified for the
orphan account account_uid.
Explanation: No valid owner is specified for the
orphan account. The account can not be adopted. The
CSV entry can not be processed.
Administrator response: Specify a valid owner that
can be used for adopting the account.
This happens when the service enforcement is set to
Alert but alert notification is disabled for account
change. Enable the Alert for account change in the
service enforcement configuration will allow the
Messages
17
CTGIMA624E • CTGIMA636E
CTGIMA624E The orphan account account_uid could
not be adopted.
Explanation: Adoption failed for the orphan account.
The CSV entry can not be processed.
Administrator response: Check the root cause for
adoption failure.
CTGIMA625E Invalid Header Name headerName
specified in the CSV file.
Explanation: The header name specified in the CSV
file is invalid. The CSV entry cannot be processed.
Administrator response: Provide correct values for the
Header Names in CSV file.
CTGIMA626E Header Name specified in the CSV
file is blank.
Explanation: Header Name specified in the CSV file is
blank. The CSV entry can not be processed.
Administrator response: Provide correct values for the
Header Names in the CSV file.
CTGIMA627E Duplicate Header Names headerName
specified in the CSV file.
Explanation: Duplicate Header Names specified in the
CSV file. The CSV entry cannot be processed.
Administrator response: Provide correct values for the
Header Names in the CSV file.
CTGIMA628E Required Header headerName are not
present in the CSV file.
Explanation: The required header is not present in the
CSV file. The CSV entry cannot be processed.
CTGIMA631E ACCOUNT_UID does not exist under
the provided PDN/URI values of
services.
Explanation: ACCOUNT_UID does not exist under
the provided PDN/URI values of services.
Administrator response: Provide the valid
ACCOUNT_UID which is present under the provided
PDN/URI values of services.
CTGIMA632E None of the specified groups exists
for the given service.Invalidvalue
Explanation: None of the specified groups exists for
the given service.GROUP_UID is invalid.
Administrator response: Provide the valid
GROUP_UID which is present under the provided
PDN/URI values of services.
CTGIMA633E The OWNER_PDN value does not
resolve to any person.
Explanation: The OWNER_PDN value does not
resolve to any person.
Administrator response: Provide the valid
OWNER_PDN value which has persons present under
it.
CTGIMA634E The specified PDN value for the
attribute PDN_value does not resolve to
any organizational containers .
Explanation: The specified PDN value does not
resolve to any organizational containers .
Administrator response: Specify a valid PDN value
that resolve to one or more organizational containers .
Administrator response: Provide required values for
the Header Names in the CSV file.
CTGIMA635E The syntax for the specfied
PDN_value value is incorrect.
CTGIMA629E
Explanation: The specified PDN value has wrong
syntax.
Root organizations are not the same.
Explanation: The root organization for the service as
well as the specified owner are not same.
Administrator response: Provide the valid owner that
resides under the same root organization as that of the
service.
CTGIMA630E
Root organizations are not the same.
Explanation: The root organization for the service as
well as the specified business unit are not same.
Administrator response: Provide the valid business
unit that resides under the same root organization as
that of the service.
18
Administrator response: Specify a valid PDN value
that have correct syntax.
CTGIMA636E The specified SERVICE_PDN does
not resolve to any services for the given
attribute
Explanation: The specified SERVICE_PDN does not
resolve to any services for the given attribute
Administrator response: Specify a valid service
attribute value which is present on services under
given PDN.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA637E • CTGIMA701E
CTGIMA637E The specified SERVICE_PDN does
not resolve to any services for the given
attribute attribute_value and/or for the
given SERVICE_TYPE value service_type
Explanation: The specified SERVICE_PDN does not
resolve to any services for the given attribute and/or
for the given SERVICE_TYPE value
Administrator response: Specify a valid attribute
value and/or SERVICE_TYPE value.
CTGIMA638E There are no services for the
specified SERVICE_ORG_CONT_URI
for the given service type.
Explanation: There are no services for the specified
SERVICE_ORG_CONT_URI for the given service type.
Administrator response: Specify a valid
SERVICE_ORG_CONT_URI and service type.
entry cannot be set to individual for accounts already
present in vault.
CTGIMA644E The value for ownership type cannot
be blank if the owners are specified.
Explanation: The value for ownership type cannot be
blank if the owners are specified.
CTGIMA645E The value specified for
CONNECT_SERVICE_PDN is invalid
for credential accountID.
Explanation: Multiple accounts were found or no
account was found for the value specified for
CONNECT_SERVICE_PDN. The CVS entry failed. The
credential is either not added to the credential vault or
not connected to the account.
CTGIMA646E The credential accountID which you
try to disconnect does not exist.
CTGIMA639E There are no services for the
specified SERVICE_ORG_CONT_PDN
for the given service type
Explanation: The credential must exist if the
DISCONNECT column is set to true.
Explanation: There are no services for the specified
SERVICE_ORG_CONT_PDN for the given service type
CTGIMA647E
Administrator response: Specify a valid
SERVICE_ORG_CONT_PDN and service type.
CTGIMA640E The specified POOL_PDN does not
resolve to any pools for the given
attribute
Explanation: The specified POOL_PDN does not
resolve to any pools for the given attribute
Administrator response: Specify a valid pool attribute
value which is present on pools under given PDN.
CTGIMA641E Specified account is suspended.
Account cannot be added to the vault.
Explanation: The specified account is suspended while
being adopted. The Ownership type specified in CSV
entry is not allowed by the provisioning policy on the
service on which this account is requested.
CTGIMA642E The ownership type specified in CSV
entry is not valid.
Explanation: The ownership type specified in CSV
entry is not valid.
CTGIMA643E The ownership type specified in CSV
entry cannot be set to individual for
accounts already present in vault.
Explanation: The ownership type specified in CSV
License metrics cannot be gathered.
Explanation: The license metrics could not be
gathered because an error occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for more
information about the error.
CTGIMA700E The workflow definition is not
saved. The following error occurred.
Error: error_text
Explanation: One or more syntax errors in the XTTL
have been detected while saving the workflow
definition.
Administrator response: Review message
CTGIMA701 for the location of the syntax errors.
This message is generated because of an XTTL error in
one of the fields containing XTTL in the Workflow
Designer. XTTL is an XML language and the contents of
these fields need to conform to XML and XTTL
standards. See the IBM Security Privileged Identity
Manager InfoCenter for more information on XTTL.
CTGIMA701E An error occurred in the activity
activity for the field field located at line
line and column: column. The parser
returned the following error. Error:
error_text
Explanation: The XTTL parser detected a syntax error
in either the Subject, Text Message Body, XHTML
Message Body, or Action Text fields within the
Workflow Designer. This message provides the details
Messages
19
CTGIMA702E • CTGIMA711W
for the error reported by message CTGIMA701E.
CTGIMA702E The workflow definition cannot be
saved. The definition_name workflow
definition cannot be found on the
server.
Explanation: There was a problem validating the
XTTL because the server was expecting an activity
definition and a null activity was detected. This is an
internal processing error.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
This is an error condition that is not expected to occur
but if it has, it indicates that in the process definition
the list of activities had one entry set to null.
CTGIMA703E The configuration in the directory
server for the tenant_name tenant cannot
be found.
Explanation: A problem occurred while retrieving
data from the directory server.
User response: Try the operation again. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA704E Communication with the directory
server cannot be established.
Explanation: The system was unable to contact the
directory server because of network problems or the
directory server is not available.
Administrator response: Verify that the directory
server is up and can be reached from the IBM Security
Privileged Identity Manager server. Review the IBM
Security Privileged Identity Manager log files for
additional information about the error.
CTGIMA706E The workflow definition cannot be
found.
Explanation: The workflow definition was not found
on the server.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA707W One or more of the selected
workflow definition cannot be deleted.
Check that you have authority to access
the definitions.
Explanation: You do not have access to one or more of
the selected workflow definitions to be deleted.
Processing continues with the workflow definitions that
you have access.
User response: Contact your administrator to obtain
access to the desired workflow designs.
CTGIMA708W The workflow definition referenced
by provisioning policies cannot be
deleted.
Explanation: You have attempted to delete a workflow
definition, which is currently referenced by a
provisioning policy. The workflow cannot be deleted.
User response: Remove the workflow definition from
the provisioning policy and then delete it.
CTGIMA709E The selection of workflow definition
names to be renamed is not correct.
Select only one definition name.
Explanation: To rename a workflow definition name
only one name must be selected. This message is a
result of either no name or more than one name was
selected.
Administrator response: Select only one entry and
click Rename.
CTGIMA710E The workflow definition name
already exists. Type another name for
the workflow.
CTGIMA705E The workflow definition cannot be
parsed.
Explanation: The same name cannot be used for
multiple workflow definition names.
Explanation: The system was unable to parse the
workflow definition file representing the activities
defined in the Workflow Designer.
Administrator response: Specify another name for the
workflow definition name.
Administrator response: Check the workflow
definition for syntax errors. Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMA711W The workflow is currently being
used. Your request cannot be processed
now. Try again later.
20
Explanation: The request for the workflow cannot be
processed until the current workflow processing is
complete.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMA712E • CTGIMA720E
Administrator response: Try the request again.
CTGIMA712E The workflow definition with the
name definition_name cannot be deleted
because it is referenced by a
provisioning policy.
Explanation: You have attempted to delete a workflow
definition, which is currently referenced by a
provisioning policy. The workflow cannot be deleted.
Administrator response: Remove the workflow
definition from the provisioning policy and then delete
it.
CTGIMA714E The workflow definition with the
name definition_name cannot be deleted
because it is referenced by an access.
Explanation: You have attempted to delete a workflow
definition, which is currently referenced by an access.
The workflow cannot be deleted.
CTGIMA719E You must specify SERVICE_URI or
SERVICE_PDN because POOL_PDN is
not specified in the CSV entry.
Explanation: You must specify SERVICE_URI or
SERVICE_PDN because POOL_PDN is not specified in
the CSV entry. The CSV entry cannot be processed.
Administrator response: Provide required values for
the Headers in the CSV file.
CTGIMA720E You must specify GROUP_UID
because POOL_PDN is not specified in
the CSV entry.
Explanation: You must specify GROUP_UID because
POOL_PDN is not specified in the CSV entry. The CSV
entry can not be processed.
Administrator response: Provide required values for
the Headers in the CSV file.
Administrator response: Remove the workflow
definition from the access and then delete it.
CTGIMA716E You must specify at least one of the
required headers in the CSV file. The
required headers are: headerName.
Explanation: You must specify at least one of the
required headers in the CSV file. The CSV entry can
not be processed.
Administrator response: Provide required values for
the Header Names in CSV.
CTGIMA717E You must specify SERVICE_TYPE if
you specified
SERVICE_ORG_CONT_URI or
SERVICE_ORG_CONT_PDN.
Explanation: You must specify SERVICE_TYPE if you
specified SERVICE_ORG_CONT_URI or
SERVICE_ORG_CONT_PDN. The CSV entry cannot be
processed.
Administrator response: Provide all required values
for the Header Names in CSV.
CTGIMA718E You must specify SERVICE_URI or
SERVICE_PDN because POOL_PDN is
not specified in the CSV.
Explanation: You must specify SERVICE_URI or
SERVICE_PDN because POOL_PDN is not specified in
the CSV. The CSV entry can not be processed.
Administrator response: Provide required values for
the Header Names in CSV.
Messages
21
CTGIMB100E • CTGIMB151E
Lifecycle management messages
CTGIMB100E The ejb_name Enterprise JavaBeans
(EJB) is missing.
CTGIMB130E The profile_name profile cannot be
found for the life cycle rule.
Explanation: The specified Enterprise JavaBeans (EJB)
cannot be found in the directory or the EJB is not
configured correctly.
Explanation: The system cannot find the profile that is
associated with the life cycle rule being processed.
Administrator response: Ensure that the specified EJB
name is configured correctly and that the directory
server is running and operating correctly. Verify there
are no network outages.
The EJB required by the
com.ibm.itim.orchestration.lifecycle lifecycle rule code
could not be located. The EJB is needed to process the
lifecycle rule. Either the EJB name was not configured
correctly or it cannot be accessed because the directory
is unavailable. Review the IBM Security Privileged
Identity Manager log file (trace.log) for any exceptions
that might have been produced.
CTGIMB110E An error occurred processing a
partition request for a life cycle rule.
Explanation: Lifecycle rule processing is divided into
partition. Each partition is processed separately, an
error occurred processing one of the partitions.
Processing of the lifecycle rule is stopped.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Entities returned by the lifecycle rule processing have
been partitioned. Records for each partition are stored
in the database. The lifecycle operation to be performed
is processed for each partition. An error occurred
processing a partition for a lifecycle rule. Review the
IBM Security Identity Manager log and trace files for
additional information. Look for error such as database
access problems and Java Message Service (JMS)
queues failures.
CTGIMB120E An error occurred starting the
operation_name life cycle rule operation.
Explanation: An internal error occurred during
orchestration of a life cycle rule operation.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An exception occurred during processing of the life
cycle rule operation. The error was detected by the
orchestration module. Check the IBM Security
Privileged Identity Manager log file (trace.log) for the
specific exception.
22
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle event handler uses references to look up
the life cycle rule that is associated with the retrieved
message. The message contained a profile name as a
reference to the life cycle rule.
CTGIMB140E The category_name category cannot be
found for life cycle rule.
Explanation: The system cannot find the category that
is associated with the life cycle rule. A category name is
one of the references that is associated with a life cycle
rule. The category name is used by internal processing
to reference a life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle event handler uses references to look up
the lifecycle rule associated with the retrieved message.
The message contained a category name as a reference
to the life cycle rule.
CTGIMB150E The rule_name life cycle rule cannot
be found for a retrieved message. Both
the profile and category was used to
locate the life cycle rule.
Explanation: The lookup for the life cycle rule
category failed. A category name is one of the
references associated with a life cycle rule. The category
name is used by internal processing to reference a life
cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle event handler uses references to look up
the life cycle rule associated with the retrieved
message. The life cycle rule could not be located using
either the profile or category references.
CTGIMB151E The rule_id life cycle rule cannot be
found in category category_name.
Explanation: The lookup for the life cycle rule for the
specified category failed. A category name is one of the
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMB152E • CTGIMB180E
references associated with a life cycle rule. The category
name is used by internal processing to reference a life
cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle event handler uses references to look up
the lifecycle rule associated with the retrieved message.
The message contained a recertification policy DN as a
reference to the life cycle rule.
The life cycle event handler uses references to look up
the life cycle rule associated with the retrieved
message. The life cycle rule could not be located using
the category reference.
CTGIMB155E The rule_name life cycle rule cannot
be found for a retrieved message. The
lifecycle rule message was invalid due
to the fact that it did not contain a type.
CTGIMB152E The rule_id life cycle rule cannot be
found in profile profile_name.
Explanation: The lookup for the life cycle rule failed
as there was no type in the message object. The type is
used by internal processing to reference a life cycle
rule.
Explanation: The lookup for the life cycle rule for the
specified profile failed. A profile name is one of the
references associated with a life cycle rule. The profile
name is used by internal processing to reference a life
cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle event handler uses references to look up
the life cycle rule associated with the retrieved
message. The life cycle rule message object was invalid
as it did not contain a type.
The life cycle event handler uses references to look up
the life cycle rule associated with the retrieved
message. The life cycle rule could not be located using
the profile reference.
CTGIMB160E An error occurred processing the
lifecycle_rule_name global life cycle rule.
CTGIMB153E The rule_id life cycle rule cannot be
found in recertification policy policyDN.
Explanation: The lookup for the life cycle rule for the
specified recertification policy DN failed. A
recertification policy DN is one of the references
associated with a life cycle rule. The DN is used by
internal processing to reference a life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle event handler uses references to look up
the life cycle rule associated with the retrieved
message. The life cycle rule could not be located using
the recertification policy DN reference.
CTGIMB154E The policyDN recertification policy
cannot be found for the life cycle rule.
Explanation: The system cannot find the recertification
policy that is associated with the life cycle rule. A
recertification policy DN is one of the references that is
associated with a life cycle rule. The recertification
policy DN is used by internal processing to reference a
life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
Explanation: Life cycle rule processing attempted to
orchestrate a global operation but an error occurred.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An error was detected by the orchestration module
while processing a global operation. Review the IBM
Security Privileged Identity Manager log file (trace.log)
for the specific exception produced.
CTGIMB180E An error occurred while accessing
data in life cycle rule database table.
Explanation: A request to retrieve or insert data in the
life cycle rule database table failed. Life cycle rule data
is stored in database tables. An error occurred accessing
the table.
Administrator response: Ensure that the database
server is available. Ensure that there are no network
outages. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
A database SQLException occurred because either a
SELECT, INSERT or DELETE in the database of a life
cycle rule failed. Review the Tivoli log file (trace.log)
for the exception and additional details.
Messages
23
CTGIMB190W • CTGIMB280E
CTGIMB190W An error occurred while retrieving
the property_name life cyle rule property
for the property_file_name property file.
CTGIMB250E The lifecycle_rule_name life cycle rule
cannot be processed because there is no
associated schedule.
Explanation: The specified property was not retrieved
from the property file. The default value for the
property will be used. Either the property file could not
be opened or the key was misspelled.
Explanation: A schedule for a life cycle rule must exist
for it to be created or modified.
Administrator response: Ensure that your life cycle
rule values are specified correctly in the property file.
CTGIMB200W An error occurred while retrieving
the property_name life cycle rule property
from the property_file_name property file.
The data found did not match the type
of data expected. The data was expected
to be an integer data type.
Explanation: The data that was retrieved for the
property was not an integer as expected. The default
value for the property will be used.
Administrator response: Ensure that the value for the
property is specified correctly in the property file.
Ensure that the value specified is an integer data type.
CTGIMB230E An error occurred while evaluating
the filter_data filter for a life cycle rule.
Explanation: The processing of a lifecycle rule filter
did not complete because an error occurred.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An exception was thrown during filter evaluation, or
the evaluation method returned a null value as the
search results object, which should not happen. Check
the log file (trace.log) for details on any exception that
occurred.
CTGIMB240E An error occurred while creating a
schedule for the lifecycle_rule_name life
cycle rule.
Explanation: An internal system error occurred when
creating the schedule for the life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An exception occurred when scheduling a life cycle
rule. Check the log file (trace.log) for details on any
exception that was thrown.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The life cycle rule should not have been accepted by
the user interface without a schedule. Review the
exceptions in the log file (trace.log). Review the life
cycle rule user interface code for errors in processing
the schedule.
CTGIMB260E An error occurred while adding the
lifecycle_rule_name life cycle rule to the
profile.
Explanation: An internal system error occurred when
adding the life cycle rule to the profile.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An attempt to add the lifecycle rule to the profile
failed. Review the log file (trace.log) for the exception
received and details about the processing before the
exception was received.
CTGIMB270E An error occurred while updating the
lifecycle_rule_name life cycle rule.
Explanation: An internal system error occurred when
updating the life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An attempt to update a life cycle rule in the profile
failed. Review the log file (trace.log) for the exception
received and details about the processing before the
exception was received.
CTGIMB280E An error occurred while updating the
schedule for lifecycle_rule_name life cycle
rule.
Explanation: An internal system error occurred while
updating the schedule for the life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An attempt to update the schedule for a life cycle rule
24
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMB290E • CTGIMB502E
failed. Review the log file (trace.log) for the exception
received and details about the processing before the
exception was received.
CTGIMB290E An error occurred while deleting the
lifecycle_rule_name life cycle rule.
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An exception occurred while evaluating a filter for a
lifecycle rule. Check the IBM Security Identity Manager
log file (trace.log) for details about the exception.
Explanation: An internal system error occurred while
deleting a life cycle rule.
CTGIMB321E The life cycle rule filter is not valid.
Check the filter syntax and try again.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Explanation: The filter syntax is incorrect.
An attempt to delete a life cycle rule failed. Review the
log file (trace.log) for the exception received and details
about the processing before the exception was received.
CTGIMB300E An error occurred while deleting the
schedule for the lifecycle_rule_name life
cycle rule.
Explanation: An internal system error occurred while
deleting the schedule for the life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An attempt to delete a schedule for a life cycle rule
failed. Review the log file (trace.log) for the exception
received and details about the processing before the
exception was received.
CTGIMB310E An error occurred while creating the
message to evaluate the
lifecycle_rule_name life cycle rule.
Explanation: An error occurred while creating the
message that is used to evaluate the life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Life cycle rules are evaluated asynchronously when the
user clicks the Evaluate button by creating a message
object and queuing it on a JMS queue. Creation of this
message object failed. Review the IBM Security
Privileged Identity Manager log file (trace.log) for
details about any exceptions that have occurred.
CTGIMB320E An error occurred while evaluating
the filter_data filter for the
lifecycle_rule_name life cycle rule.
Explanation: An internal system error occurred while
evaluating the life cycle rule filter.
Administrator response: Correct the syntax error and
try again.
Review the IBM Security Privileged Identity Manager
log file (trace.log) for details about the exception.
CTGIMB500E The operation operation_name cannot
be removed because of dependency on
the following life cycle rules:
life_cycle_rules
Explanation: The operation cannot be removed until
there are no life cycle rules that reference it.
Administrator response: Remove the dependency
from lifecycle rule and try again.
CTGIMB501E The operation_name operation cannot
be removed because the system is
unable to verify if there are any life
cycle rule dependencies associated with
the operation.
Explanation: An error occurred when the system
attempted to verify if there are any life cycle rule
dependencies for the operation.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An exception was thrown during dependency check for
this operation removal. Review the log file (trace.log)
for details about the exception.
CTGIMB502E The profile_name profile cannot be
found.
Explanation: The system was unable to find the
profile selected.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated when a profile is needed for
processing a life cycle rule request. Review the log file
(trace.log) for the profile name logged.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
Messages
25
CTGIMB503E • CTGIMB510E
CTGIMB503E The category_name category cannot be
found.
CTGIMB507E An error occurred while adding the
lifecycle_rule_name life cycle rule.
Explanation: The system cannot find the selected
category.
Explanation: An internal system error occurred
adding the life cycle rule.
Administrator response: An internal system error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated when a category is needed
for processing a life cycle rule request. Review the log
file (trace.log) for the category name logged.
This message is generated from webclient tier when
there is an exception adding a lifecycle rule. Check the
log file (trace.log) for the exception trace and the root
cause of this error.
CTGIMB504E The life cycle rule with the
lifecycle_rule_id ID cannot be removed.
Explanation: An internal error occurred removing the
life cycle rule.
Administrator response: An internal processing error
occurred, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated when a there is an exception
in removing of lifecycle rule. Review the log file
(trace.log) for the exception trace and the root cause of
the error.
CTGIMB505E All the selected life cycle rules cannot
be evaluated. The life cycle rule with
the rule_ids ID cannot be evaluated.
Explanation: An internal system error occurred
evaluating all the selected life cycle rules.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated when a there is an exception
in one or more lifecycle rule in a multi-evaluation
request. Check the trace.log for the exception trace and
the root cause of this error.
CTGIMB506E An error occurred while looking up
the life cycle rule list.
Explanation: An internal system error occurred
looking up the life cycle rule list.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Received either the RemoteException,
CreationException, or NamingException while locating
the life cycle rule list. Review the log file (trace.log) for
the exception and the root cause of this error.
26
CTGIMB508E An error occurred while modifying
the lifecycle_rule_name life cycle rule.
Explanation: An internal system error occurred
modifying the life cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated from webclient tier when
there is an exception modifying a lifecycle rule. Check
the log file (trace.log) for the exception trace and the
root cause of this error.
CTGIMB509E An error occurred while deleting the
lifecycle rules associated with the
category_name category or profile_name
profile.
Explanation: A system error occurred deleting a life
cycle rule.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated from webclient tier when
there is a RemoteException deleting a lifecycle rule.
Review the log file (trace.log) for the exception and the
root cause of this error.
CTGIMB510E An error occurred while submitting a
life cycle rule for evaluation.
Explanation: The system is unable to evaluate the
lifecycle rule due to an exception that occurred.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
A RemoteException occurred when the webclient tier
attempted to evaluate a life cycle rule. Review the log
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMB511E • CTGIMB518E
file (trace.log) for the exception and the root cause of
this error.
CTGIMB511E An error occurred while looking up
the operations for the life cycle rule
associated with the category_name
category or profile_name profile.
Explanation: A system error occurred while looking
up the operations for the life cycle rule.
Administrator response: An internal processing error
occurred, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An exception occurred while the webclient tier
attempted to look up an operation defined on the
General tab associated with the the life rule. Review the
log file (trace.log) for the exception and root cause of
the error.
CTGIMB512E An error occurred while looking up
the life cycle rule.
Explanation: The system is unable to look up the
selected lifecycle rule due to an exception that
occurred.
Administrator response: An internal processing error
occurred, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated from webclient tier when
there is an exception looking up the selected lifecycle
rule. Check the trace.log for exception trace and the
root cause of this error.
CTGIMB513E The selected operation does not exist
in this entity .
Explanation: The system is unable to locate the
selected operation. This operation might reside in the
entity-type location.
Administrator response: Make sure the selected
operation exist in the entity.
This message is generated from EntityManagerBean
removeOperation(). The operation selected is not found
in the selected profile.
CTGIMB514E The selected operation cannot be
removed because it is a system
operation.
Explanation: Removal of a system operation is not
allowed by the system.
Administrator response: Do not remove the operation.
CTGIMB515E The workflow definition associated
with the operation cannot be removed.
Explanation: The system is unable to remove the
workflow definition of the operation due to an internal
error.
Administrator response: An internal processing error
occurred, Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated from EntityManagerBean
removeWFDesign() from removeOperation(). Check the
trace.log for exception trace and the root cause of this
error.
CTGIMB516E An internal error occurred while
removing the workflow definition for
the operation. The definition is not
removed.
Explanation: The system is unable to remove the
workflow definition of the operation because of an
internal error.
Administrator response: An internal processing error
occurred, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated from EntityManagerBean
getWfDesignerManager(). The system is unable to
create/locate WfDesignerManagerBean EJB. Check the
trace.log for exception trace and the root cause of this
error.
CTGIMB517E An internal processing error occurred
while removing the selected operations.
The operations cannot be removed.
Explanation: The system is unable to remove the
selected operations because of an internal error.
Administrator response: An internal processing error
occurred, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
This message is generated from EntityManagerBean
removeOperation(). This error might come from a
dataservice exception. Check the trace.log for exception
trace and the root cause of this error.
CTGIMB518E Attribute mapping is invalid due to
syntax mismatch or value mismatch for
these attributes: invalid_mapping_attributes
Explanation: The attribute mapping defined is not
valid because the syntax type of the mapping attribute
to the mapped attribute does not match or the value
type.
Administrator response: Please make sure to map the
Messages
27
CTGIMB519E • CTGIMC100E
attributes which match syntax, value wise. Valid value
types are single-value to single-value or multi-value to
multi-value or single-value to multi-value.
Administrator response: Please make sure that the
schema for custom ldap class is created in the directory
server and try again.
CTGIMB519E The following mapped attributes
mapped_attributes are not part of the
schema.
CTGIMB524E Invalid ldap class [custom_ldap_class]
as it is in use for another profile. Please
use different LDAP class.
Explanation: The attributes that are mapped are not
valid, they must be part of the schema for the custom
ldap class.
Explanation: The selected ldap class for the profile
should not already being used for other profile.
Administrator response: Please make sure that
mapped attributes are part of the schema for the
custom ldap class.
CTGIMB520E The following new schema attributes
new_schema_attributes are part of the
superior class schema.
Explanation: The new schema attributes already exists
in the superior class attributes.
Administrator response: Please make sure to define
new schema attributes which are not part of superior
class attributes.
CTGIMB521E The custom ldap class name cannot
start with er.
Explanation: The custom ldap class name that starts
with er is not allowed in ITIM.
Administrator response: Please make sure to enter the
custom ldap class name that doesn't start with er.
CTGIMB522E Unable to update schema to the
directory for custom_class ldap class
reason.
Explanation: Unsuccessful in updating the schema to
the directory server.
Administrator response: Please make sure that the
schema definitions are valid.
CTGIMB523E Unable to create default form
template for custom ldap class
custom_ldap_class.
Administrator response: Please make sure that the
ldap class is not used for other profile and does not
start with er, then try again.
CTGIMB525E Cannot specify top for ldap class.
Please specify a different LDAP class.
Explanation: The use of top for ldap class definition is
not allowed.
Administrator response: Please make sure to specify a
ldap class other than top.
CTGIMB526E Ldap class [custom_ldap_class] cannot
be same as superior class. Please specify
different LDAP class.
Explanation: The ldap class specified for ldap class
name and superior class name cannot be the same.
Administrator response: Please make sure to specify a
different custom class for custom class name and
superior class name.
CTGIMB527E Entity with name entity_name already
exist. Cannot create entity.
Explanation: Entity name should be unique.
Administrator response: Change entity name and try
again.
CTGIMB528E Operation with name operation_name
already exists.
Explanation: Operation name should be unique.
Administrator response: Change operation name and
try again.
Explanation: Unsuccessful in creating default form
template for the custom ldap class.
Post office management messages
CTGIMC100E The interval value is not valid. Enter
a value between minimum_value and
maximum_value.
Explanation: The value for the collection interval on
the Post Office page is not valid. The value for the
collection interval must be an integer within the range
specified in the message.
28
Administrator response: Change the value for the
Collection Interval field, and click Done.
A configuration error occurred for the post office
component. A message is written to the log file.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMC101E • CTGIMC107E
CTGIMC101E The value in the XHTML Body field
exceeds the maximum number of
characters. The maximum number of
characters for this field is maximum_value
characters.
Explanation: The value for the XHTML Body field on
the Post Office page exceeds the maximum number of
characters. The email message defined in this field
must not exceed the maximum number of characters
that is specified in the message.
Administrator response: Reduce the number of
characters for the XHTML Body field, and click Done.
A configuration error occurred for the post office
component. A message is written to the log file.
CTGIMC102E The value in the Text Body field has
exceed the maximum number of
characters. The maximum number of
characters for this field is
maximum_value.
Explanation: The value specified in the Text Body
field on the Post Office page exceeds the maximum
number of characters. This field must contain fewer
characters than the maximum number of characters
that is specified in the message.
Administrator response: Reduce the number of
characters for the Text Body field, and click Done.
A configuration error occurred for the post office
component. A message is written to the log file.
CTGIMC103E The value in the Subject field
exceeds the maximum number of
characters. The value contained in the
Subject field must be less than
maximum_value characters.
Explanation: The value in the Subject field exceeds the
maximum number of characters. This field must
contain fewer characters than the maximum number of
characters that is specified in the message.
Administrator response: Reduce the number of
characters for the value in the Subject field, and click
Done.
A configuration error occurred for the post office
component. A message is written to the log file.
CTGIMC104E An error occurred while parsing the
Subject field value. The value entered
for the Subject field contains an
incorrect dynamic content tag. The error
is located around line line_number and
column column_number.
Explanation: A dynamic content tag that is located
around the specified line and column in the Subject
field is not recognized. Check that the syntax is correct
for the tag and both the start and end tags are
included.
Administrator response: Review the specified text for
any incorrect coding. Make the necessary corrections,
and click Done to submit the form.
A configuration error occurred for the post office
component. The value for the Subject field contains an
incorrect coding. A message is written to the log file.
CTGIMC105E An error occurred while parsing the
Text Body field value. The value
contains an incorrect dynamic content
tag. The error is located around line
line_number and column column_number.
Explanation: A dynamic content tag that is located
around the specified line and column in the Text Body
field is not recognized. Check that the syntax is correct
for the tag and that both the start and end tags are
included.
Administrator response: Review the specified text for
any incorrect coding. Make the necessary corrections,
and click Done to submit the form.
A configuration error occurred for the post office
component. The value for the Text Body field contains
an incorrect coding. A message is written to the log file.
CTGIMC106E An error occurred while parsing the
XHTML Body field value. The value
entered for the XHTML Body contains
an incorrect dynamic content tag. The
error is located around line line_number
and column column_number.
Explanation: A dynamic content tag that is located
around the specified line and column in the XHTML
Body field is not recognized. Check that the syntax is
correct for the tag and both the start and end tags are
included.
Administrator response: Review the specified text for
any incorrect coding. Make the necessary corrections,
and click Done.
A configuration error occurred for the post office
component. The value for the XHTML Body field
contains an incorrect coding. A message is written to
the log file.
CTGIMC107E An error occurred while parsing the
Subject field value. The value in the
Subject field contains an incorrect
dynamic content tag.
Explanation: A tag coded in the Subject is not
recognized. Check that the syntax is correct for the tag
and both the start and end tag are included.
Administrator response: Review the specified text for
Messages
29
CTGIMC108E • CTGIMC113E
any incorrect coding. Make the necessary corrections,
and click Done.
A configuration error occurred for the post office
component. The value for the Subject field contains an
incorrect coding. A message is written to the log file.
CTGIMC108E An error occurred parsing the Text
Body field value. The value entered for
the Text Body field contains an incorrect
dynamic content tag.
Explanation: A tag coded in the Text Body field is not
recognized. Check that the syntax is correct for the tag
and that both the start and end tags are included.
Administrator response: Review the specified text for
any incorrect coding. Make the necessary corrections,
and click Done to submit the form.
A configuration error occurred for the post office
component. The value for the Text Body field contains
an incorrect coding. A message is written to the log file.
CTGIMC109E An error occurred while parsing the
XHTML body value. There is a
JavaScript coding error in the field.
Explanation: A syntax error occurred parsing the
XHTML Body value of the aggregate message template.
CTGIMC111E An error occurred while storing the
Post Office configuration data.
Explanation: Configuration data specified on the Post
Office page cannot be stored into the directory server.
Administrator response: Verify that the LDAP server
is available and there are no network outages and try
the operation again. If the problem persists, check IBM
Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt to place the configuration data in the LDAP
database for the post office component failed. Review
the scheduler code for problems. A message is written
to the log file.
CTGIMC112E An error occurred while retrieving
the default properties information for
your organization. The configuration
data is not saved.
Explanation: Information specified about the
organization at installation time could not be retrieved
from the system properties file. The missing
information was specified during installation on the
Default Organization Short Name property. A value for
the field was not entered or the data is corrupted.
Administrator response: Review the specified text for
any incorrect coding. Review the log files for additional
information about the error. Make the necessary
corrections, and click Done to submit the form.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman about updating the system
properties file.
An error occurred when parsing the XHTML Body field
for the post office component. A message is written to
the log file. Review the log file for additional messages
that contain the error type and general location of the
error.
An error occurred retrieving configuration data for the
post office component. The default organization short
name value is missing in the enRole.properties file. The
file must edited and the default name added.
CTGIMC110E An error occurred while retrieving
the Post Office configuration data.
Explanation: Configuration data specified on the Post
Office page cannot be retrieved from the directory
server.
Administrator response: Verify that the LDAP
directory server is available and there are no network
outages and try the operation again. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An attempt to retrieve the configuration data from the
LDAP database for the post office component failed.
Review the scheduler code for problems. A message is
written to the log file.
30
CTGIMC113E An error occurred while generating
the aggregated message. The notification
messages were saved for aggregation
and will be sent individually. Email
address: email_address Topic: topic_id.
Explanation: A problem was encountered while
executing the aggregation template for the Collection
Interval. There could be a problem with the
aggregation template as defined on the user interface
Post Office Configuration page.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Review the aggregation
template defined on the Post Office Configuration page.
Use the Test feature on the interface to find the error.
Make the necessary corrections to the template. The
new template will be used for the next collection
interval.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMC114E • CTGIMC204E
CTGIMC114E The value for both the Text Body and
XHTML Body fields are empty. At least
one of these fields must be specified.
Explanation: Both the Text Body and XHTML Body
fields do not have a value specified. At least one must
be specified. The Text Body field is used when sending
an aggregated notification message to recipient with
both text and Web browser supported. The XHTML
body field is used when sending a message to a
recipient with Web browser support.
Administrator response: From the Post Office page
click the Aggregate Message tab and provide a value
for one or both of the Text Body and XHTML Body
fields.
A configuration error occurred for the post office
component. A required value is not specified.
CTGIMC115E The notification messages
aggregation is not available. An error
occurred retrieving the aggregation
template from the directory server.
Notification messages will be sent
individually.
Explanation: An error occurred while retrieving the
aggregation template from the directory server. The
template could not be retrieved causing aggregation of
notification messages not to be performed. The
messages will be sent individually.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the problem. Check that the
aggregation template is configured correctly on the Post
Office Configuration pages in the user interface.
CTGIMC200E The notification message cannot be
stored because communication with the
IBM Security Identity Manager database
is not available.
Explanation: An attempt to store a notification
message for later delivery did not complete because
connection to the database does not exist. The
notification message is forwarded to the recipient.
Administrator response: Verify that the IBM Security
Privileged Identity Manager database is available and
there are no other network outages. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
An error occurred attempting to place a new record in
the database. The IBM Security Identity Manager server
could not communicate with the database. Verify that
connections between the server and database are
configured correctly. A message is written to the log
file.
CTGIMC201E An error occurred establishing
communication with the database
attempting to store a message. The
message is forwarded to the recipient.
Explanation: An attempt to store a message for later
delivery did not complete because the connection to the
database does not exist. The message is forwarded to
the recipient.
Administrator response: Verify that the IBM Security
Privileged Identity Manager database is available and
there are no other network outages. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMC202E An error occurred while storing a
notification message to the database for
later delivery.
Explanation: An attempt to store a notification
message into the database cannot be completed because
communication with the database is unavailable.
Administrator response: Verify that the IBM Security
Privileged Identity Manager database is available and
there are no other network outages. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The post office interception component cannot access
the notification table. A message is written to log file.
The notification will not be intercepted.
CTGIMC203E An internal error occurred while
creating the message sender.
Explanation: The message sender information needed
to send asynchronous message for processing a post
office topic cannot be found. There could probably be a
problem with the Java Message Service (JMS) queues.
Administrator response: Review the application
server and IBM Security Privileged Identity Manager
log files to determine if any corresponding exceptions
occurred. Check if there are problems with the JMS
messaging queues. Application server tools can be used
to validate that the JMS messaging queues are working
correctly. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
A message is written to the log file. The notification
will not be intercepted.
CTGIMC204E The message sender could not be
found.
Explanation: An internal error occurred aggregating
notification messages. An attempt to an asynchronous
Messages
31
CTGIMC205E • CTGIMC210E
message to the Java Message Service (JMS) queues
failed.
Administrator response: Review the application
server and IBM Security Privileged Identity Manager
log files to determine if any corresponding exceptions
occurred. Check if there are problems with JMS
messaging queues. Application server tools can be used
to validate that the JMS messaging queues are working
correctly. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The post office notification component cannot update
the topic table for the originator of the message.
Investigate for potential problem with the JMS
messaging queues or with JNDI lookup of Enterprise
JavaBeans (EJB) home for message sender EJB.
CTGIMC205E An internal error occurred while
aggregating a set of notification
messages. An aggregated message
cannot be sent.
Explanation: An internal error occurred while locating
all notification messages to aggregate.
Administrator response: Verify that the WebSphere
Application Server Java Message Service (JMS) queues
are working correctly.
The post office notification component cannot update
the the JMS queue to complete the aggregation process.
CTGIMC206E An internal error occurred while
updating the topic table.
Explanation: An error occurred adding a record into
the topic table.
Administrator response: Verify that the IBM Security
Privileged Identity Manager database is available and
there are no other network outages.
An attempt to update the topic table with additional
records by the post office component failed.
CTGIMC207E An error occurred while processing a
JavaScript tag contained in the aggregate
template message. The aggregate
notification message is not sent.
Explanation: The aggregated template contained
JavaScript that required processing before the
aggregated notification message could be sent to the
recipient. The call to the FESI Interpreter to process the
JavaScript failed. The collected messages will be sent
individually.
Administrator response: Review the application
server and IBM Security Privileged Identity Manager
log files for additional information.
The FESI object produced a JSException while the post
32
office component was trying to construct the interface
required to handle the processing of any JavaScript
found in the aggregation template. The FESI object
must complete successfully to process the stored
messages and compose the aggregate message. The
post office component processing to aggregate
messages at the next interval.
CTGIMC208E An error occurred while processing a
IBM Security Privileged Identity
Manager dynamic content tag contained
in the aggregate template message. The
aggregated notification message is not
sent.
Explanation: Processing of a IBM Security Privileged
Identity Manager dynamic content tags did not
complete. An error occurred adding a model extension
to the FESI extension necessary for processing the
dynamic content tag.
Administrator response: Review the WebSphere
Application Server system and IBM Security Privileged
Identity Manager log files for additional information.
The post office FESI topic daemon failed to create a
model extension to the FESI extension.
CTGIMC209E The person search based on an email
address did not locate anyone associated
with the email address. Stored
notification messages will be sent
individually.
Explanation: The aggregation template contained a
person search request based on an email address. The
person search processing did not complete successfully.
Either the person does not exist in the system or their
email address has changed recently. Aggregation of the
notification for the email address will not be
performed.
Administrator response: Review the aggregation
template message to determine if corrections need to be
made.
The post office FESI extension failed to locate a person
object associated with the passed email address.
CTGIMC210E The person search based on an email
address cannot complete because an
email address is not specified for the
search.
Explanation: The aggregation template contained a
person search request based on an email address. The
search is a result of the getPersonByEmailAddress
JavaScript tag specified. If the tag is coded correctly, an
internal processing error occurred.
Administrator response: Review the aggregation
template message to determine if corrections need to be
made.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMC211E • CTGIMC215E
The FESI extension code failed to find an email address
in the context passed to it by the FESI interpreter. This
is normally the result of an internal error putting the
email address in the context object prior to invoking
the FESI interpreter to process the aggregate template.
Administrator response: Verify that the database
server is available and there are no network outages
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMC211E The topic search based on a specified
topic cannot be completed because of an
internal error.
The post office component attempted to create a
recurring schedule work item for the schedule
component to process. The work item causes the
schedule component to process email aggregation at the
specified interval. This could be caused by a database
connection failure. Review the scheduler code for
problems. A message is written to the log file.
Explanation: The aggregation template contained a
getTopic JavaScript tag, but no topic was passed to the
code to process the JavaScript request. The aggregate
message template is specified on the Post Office page.
Administrator response: Review the aggregation
template message to determine if corrections need to be
made. If the tag is coded correctly, an internal
processing error occurred. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
The post office FESI extension code failed to find the
topic in the context passed to it by the FESI interpreter.
This is normally the result of an internal error putting
the topic in the context object prior to invoking the
FESI interpreter to process the aggregate template.
CTGIMC212E An error occurred retrieving your
organization's default properties
information. The configuration data is
not saved.
Explanation: Information specified about the
organization at installation time could not be retrieved
from the system properties file. The information
missing is specified during installation on the Default
Organization Short Name field. A value for the field
was not entered or the data is corrupted.
CTGIMC214E A request to aggregate notification
messages and forward to the recipient
failed. The work item to schedule the
aggregation could not be created.
Explanation: An internal error occurred creating a
schedule to cause aggregation of messages to occur
immediately.
Administrator response: Verify that the IBM Security
Privileged Identity Manager database server is available
and there are no network outages. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The post office component attempted to create a one
time schedule work item for the schedule component to
process. The work item causes processing of email
aggregation immediately. This could be caused by a
database connection failure. Review the scheduler code
for problems. A message is written to the log file.
CTGIMC215E A recurring schedule cannot be
found.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman about updating the system
properties file.
Explanation: There was a problem finding the
recurring schedule in the system that causes email
aggregation to occur on the given interval. This should
not happen and is most likely an internal processing
error.
A configuration error occurred for the post office
component. The default organization short name value
is missing in the enRole.properties file. The file must
edited and the default name added.
Administrator response: Verify that the database
server is available and there are no network outages
and try the operation again. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMC213E A recurring schedule work item
cannot be created to poll for messages to
perform message aggregation.
Notification messages will be sent
individually when received.
Explanation: An internal error occurred creating the
recurring schedule to poll for notification messages to
aggregate based on the Collection Interval value
specified on the Post Office page. Messages will be sent
individually.
This message is generated configuring the post office
component. An attempt to get the recurring schedule in
the scheduler failed. This recurring schedule causes the
system to process email aggregation at the specified
interval. This could be caused by a DB connection
failure. Review the scheduler code for problems. A
message is written to the log file.
Messages
33
CTGIMC216E • CTGIMD007E
CTGIMC216E A request to cancel aggregation of
notification messages failed.
Aggregation of messages will continue.
Explanation: An internal error occurred canceling a
recurring work item to stop aggregation of notification
messages based on a collection interval.
Administrator response: Verify that the IBM Security
Privileged Identity Manager database server is available
and there are no network outages. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The post office component attempted to cancel a
recurring schedule work item to stop aggregation of
messages based on a collection interval. This could be
caused by a database connection failure. Review the
scheduler code for problems. A message is written to
the log file.
CTGIMC217E There was a problem reading the test
email contents from java_property_file.
The field that had a problem was
java_property_name and
Explanation: Testing of the Post Office Templates
could not be completed because the test email contents
could not be read from the mentioned property file.
Administrator response: Verify the information in the
message exist on the system. If changes are required,
the application server will need to be restarted in order
to pick up the changes.
If the properties in the property file are not available,
this problem will occur. Have the customer check the
property file for the default test data.
Remote services messages
CTGIMD001E The resource does not support the
search function.
Explanation: The adapter does not support the search
with a filter function. This function cannot be used to
find a reconciliation for the resource.
Administrator response:
CTGIMD002E A policy violation occurred for
service_name.
Explanation: Some type of policy violation occurred.
This message is contained in the response e-mail
subject line. Message CTGIMD003E contains the text in
the response e-mail sent to the requestor.
Administrator response: Review the Completed
request page for details related to the policy violation.
Make the necessary adjustments based on the
information provided.
CTGIMD003E At least one account on the
service_name service violates the policy.
See the reconciliation report for details.
Explanation: Some type of policy violation occurred.
This message is contains the body text in the response
e-mail. Message CTGIMD002E contains the subject line
in the response e-mail.
Administrator response: Review the Completed
request page for details related to the policy violation.
Make the necessary adjustments based on the
information provided.
CTGIMD004E The user ID cannot be obtained for
the entry_name entry from the entry
domain name.
34
Explanation: The data sent from the agent for the
reconciliation did not contain a user ID.
Administrator response: Make sure the name attribute
is correct in the agent configuration data.
The entry name field for an entry sent by the agent did
not contain a uid=.
CTGIMD005E There is a configuration problem
with the service definition. The
class_name object is not the expected
object to be returned by the orphan
adoption script.
Explanation: A configuration error occurred. The
orphan adoption script being used for the service is
incorrect.
Administrator response: Correct the orphan adoption
script being used for the service to ensure it returns the
correct object class. An array containing one entry of
object class
com.ibm.itim.dataservices.model.domain.Person[ ], or a
null value, is expected.
CTGIMD006E An error occurred while processing
the orphan adoption script. The
following error occurred. Error: error_text
Explanation: A logic error occurred processing the
JavaScript within the orphan adoption script.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMD007E A duplicate user ID was returned by
the resource during reconciliation. The
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD008E • CTGIMD019E
duplicate user ID is user_id
Explanation: The resource returned the same user ID
more than once. The first user ID returned is used.
Administrator response: Locate the duplicate user IDs
and make the necessary changes. Keep in mind that the
IBM Security Identity Manager server treats user IDs as
case-insensitive. For example, Name and name are
recognized as the same user ID.
CTGIMD008E An error occurred while accessing the
database during reconciliation. The
following error occurred. Error: error_text
Explanation: An exception was returned by the
database access code.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMD009E An error occurred while updating the
account_name account.
Explanation: An attempt to create an orphan account
after receiving the reconciliation results failed. An error
occurred while creating the directory entry for the
account.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Look for a schema
violation within the directory server.
CTGIMD010E More than one person matched the
filter value filter in the container_name
container.
Explanation: The specified filter value did not identify
a unique person in the directory server, when using the
specified container (organization, business unit,
location) as the search base.
Administrator response: Change the filter value to be
more specific and try the search again.
CTGIMD011E The Person profile cannot be found
for the class_name object class.
Explanation: The list of object classes specified for the
Person entry did not match a configured Person or
Business Partner Person profile. The object class
attribute must be defined and must match the directory
server object class that has been mapped to the person
type you want to add.
Administrator response: Correct the class value in the
input source (such as HR feed file or the Java Naming
and Directory Interface (JNDI)).
CTGIMD012E An error occurred submitting the
REQUEST_TYPE request for the entry_dn
entry. Error: error_text
Explanation: The workflow orchestrator component
returned an exception error when the request was
submitted to it. This is an internal processing error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD013E The result from the person placement
rule script is not valid. The
return_class_type class type is not the
expected type.
Explanation: The person placement rule script for the
service returned an incorrect result type. It should have
returned a String, or null.
Administrator response: Review the person placement
rule JavaScript for a logic error causing the wrong class
type to be returned.
CTGIMD015E An error occurred while reading the
request record data from the database.
Explanation: An internal IBM Security Privileged
Identity Manager server processing error occurred.
Administrator response: Review the logs for further
details of the database error. If necessary, check IBM
Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD017E The service lock object cannot be
found.
Explanation: The service lock object has not yet been
created for this service instance. This is an internal
notification message that occurs when the first request
is issued to a new service.
CTGIMD018E The password for a suspended
account cannot be changed.
Explanation: Passwords for suspended accounts
cannot be changed.
Administrator response: Verify that the password
change is being made for the correct account.
CTGIMD019E The resource definition properties
cannot be loaded.
Explanation: An error occurred loading the service
definition properties for a service. This can occur if a
Messages
35
CTGIMD020E • CTGIMD028E
service profile is deleted, or upgraded to an
incompatible version, while there exist service instances
of this profile type. It can also occur due to data
integrity problems with the directory server.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory log files for
additional information about the error.
CTGIMD020E Error obtaining the tenant properties
from enRole.properties while processing
adapter event notification message or
asynchronous reply message. Service:
service_name Error message: error_message.
Explanation: An Exception occurred obtaining tenant
properties from enRole.properties.
Administrator response: Verify the values of the
enrole.defaulttenant.id and enrole.ldapserver.root
properties in enRole.properties are valid.
CTGIMD021E The reconciliation time limit is
exceeded.
CTGIMD024E
The reconciliation filter is not valid.
Explanation: The reconciliation filter specified on the
reconciliation filter tab is invalid.
Administrator response: Correct the specified
reconciliation filter.
CTGIMD025E The syntax for one of the
reconciliation attributes is not correct.
Explanation: One of the attribute names specified in
the Service Reconciliation Schedule Query tab is not a
valid name.
Administrator response: Correct the attribute names
list.
CTGIMD026E More than one person has been
found matching the name specified in
the Identity Feed Entry DN field.
Service: service_name Entry name:
entry_dn
Explanation: The reconciliation request took longer
that the maximum time that was configured on the
Service Reconciliation Schedule Tab.
Explanation: An entry in the identity feed source
(such as a DSML field for a DSML Identity Feed)
matches more than one single person in the IBM
Security Privileged Identity Manager Directory.
Administrator response: Increase reconciliation
timeout to a higher value.
Administrator response: Correct the entry DN in the
identity feed source.
CTGIMD022E An error occurred obtaining the
message transformer used to perform
attribute conversions for the service.
CTGIMD027E
The user_name person already exists.
Explanation: An attempt has been made to add a
person that already exists. This can occur due to race
Explanation: An error occurred obtaining the message
conditions, where two simultaneous attempts are made
transformer used to perform attributes conversions.
to add the same person, such as two Identity Feeds
This message indicates the service definition property
running in parallel, or two administrators creating the
com.ibm.itim.remoteservices.ResourceProperties.TRANSFORMER
same person at the same time. It can also occur if the
does not specify the name of a valid transformer class.
JNDI identity feed interface, or the IBM Security
Privileged Identity Manager application program
Administrator response: Verify the service profile was
interface (API), is used to add a person that already
installed from a valid source for this version of IBM
exists.
Security Privileged Identity Manager. Check IBM
Electronic Support for additional information
Administrator response: If due to a race condition,
-www.ibm.com/software/sysmgmt/products/support/
verify the existing person is correct. If due to use of the
index.html?ibmprd=tivman about obtaining a corrected
JNDI identity feed or IBM Security Privileged Identity
service profile.
Manager API interface, correct program logic.
The service profile TRANSFORMER attribute did not
specify the name of a class that implements the
CTGIMD028E An unexpected error occurred while
com.ibm.itim.remoteservices.transformation.MessageTransformer
processing a remote services request.
interface.
Error: error_text
Explanation:
CTGIMD023E
The distinguished name is not valid.
Administrator response:
Explanation: The service base DN field does not
specify a valid distinguished name.
Administrator response: Correct the base DN. This
field is specified in the service definition form (not
used for all service types).
36
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD029E • CTGIMD049E
CTGIMD029E An error occurred while configuring
the service connector.
Explanation: See message.
Administrator response: Check the service profile for
errors and compatibility with the version of IBM
Security Privileged Identity Manager.
CTGIMD030E The syntax of the distinguish_name
distinguished name (DN) is not valid.
Explanation: The distinguished name received from
the adapter is not valid.
Administrator response: Check the identity feed input
file and adapter configuration for the distinguish name
value specified.
CTGIMD032E Invalid failure threshold property
value for property_name in file_name.
Explanation: Invalid failure threshold property value
in enrole property file.
Administrator response: Check for
enrole.reconciliation.failurethreshold property value in
enRole.properties file.
CTGIMD037W
Orphan Adoption Script not found.
Explanation: Orphan Adoption Script not found.
Administrator response:
CTGIMD038E No service owner to send policy
warnings to, service:service_name
Explanation: No service owner found to send policy
failure warning.
Administrator response:
CTGIMD039E Invalid cache size property value for
property_name in property_file_name
Explanation: Invalid cache size property in
enRole.properties file.
Administrator response: Check
enrole.reconciliation.accountcachesize property value in
enRole.properties file.
CTGIMD040E PropertiesManager is unable to read
property value for property_name in
property_file_name : Cause cause
Explanation: Unable to read properties file.
CTGIMD034W Account not allowed: No entitlement
found for account.
Explanation: Policy compliance for account is
DISALLOWED.
Administrator response:
Administrator response: Check for property name in
property file. See log message for more details.
CTGIMD041E Request record type
request_record_type is unknown.
Explanation: Request record type is unknown.
CTGIMD035E Policy Analysis error encountered
while evaluating Account account_name
bypass account.
Explanation: Policy Analysis error encountered while
evaluating account.
Administrator response:
CTGIMD042E Request record operation
request_record_operation is unknown.
Explanation: Request record operation is unknown.
Administrator response: Review log files for
additional information about the error.
Administrator response:
CTGIMD036W Unexpected Policy Compliance state
-- assuming NON_COMPLIANT; User
id=user_id
CTGIMD043E Unable to process request by agent
cause: request returned from
ServiceProvider, remote
status=remote_status , reason=reason_text
Explanation: Policy compliance for account is
NONCOMPLIANT.
Explanation: Adapter is unable to process request.
Administrator response: Review the IBM Security
Privileged Identity Manager log file for policy
compliance state.
Administrator response: Review the IBM Security
Privileged Identity Manager log details for additional
information about the error.
CTGIMD049E The dynamic role role_name definition
could not be evaluated for person
person_name.
Explanation: Dynamic role could not be evaluated for
the person specified.
Messages
37
CTGIMD050W • CTGIMD061E
Administrator response:
CTGIMD050W Workflow activity defined for
reconciliation terminated. Cause :
reconciliation timed out. expired at:
expiry_time_of_reconciliation, current
entryNumber =entry_number
Explanation: The workflow activity defined for
reconciliation has terminated.
Administrator response:
CTGIMD051W Workflow ProcessID =process_id ,
Process state = ABORTED,
reconciliation cancelled by user.
Explanation: Reconciliation is aborted by user, closing
connection to remote service.
CTGIMD052W Reconciliation result status was
Failure. Number of entries
processed:number_of_entries, Status
Reason Message:reason_message
Explanation: Reconciliation result status was Failure.
CTGIMD053E Failed to initialize the workflow
queues. Cause cause
Explanation: Failed to initialize the workflow queues.
Administrator response: Review the IBM Security
Privileged Identity Manager log details for additional
information about the error.
CTGIMD054E Error occurred while processing
response. Cause cause
Explanation: Error occurred while processing
response.
Administrator response: Review the IBM Security
Privileged Identity Manager log details for additional
information about the error.
CTGIMD055E Unable to access remote resource
remote_resource_path
Explanation: Unable to access remote resource.
Administrator response:
CTGIMD056E Reconcile requestID=request_id not
started; recon already in progress,
current requestID=request_id , started at
start_time
Explanation: New reconciliation cannot start because a
reconciliation is already running.
Administrator response:
38
CTGIMD057W
schema_file_name does not exist.
Explanation: Schema file not found.
Administrator response: Check for file path.
CTGIMD058E IOException locating the message
transformer: error_text
serviceProviderInfo =service_provider_info
Explanation: IO error occurred while locating the
message transformer.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about error.
CTGIMD059E The reconciliation maximum number
of local accounts to delete
(threshold_value) was exceeded: Total old
and new local accounts = accounts_total;
Number of old accounts to delete =
residual_total.
Explanation: The configured maximum number of
local accounts to delete by reconciliation was exceeded.
None of the local accounts (or supporting data) that no
longer exist on the adapter were deleted.
Administrator response: Review the IBM Security
Privileged Identity Manager and adapter log files to
verify why the number of accounts to delete exceeded
the configured limit. Either correct the issue that caused
the limit to be exceeded, or change the threshold value
to a higher value. Then re-run the reconciliation. This
threshold is defined by the
enrole.reconciliation.failurethreshold property in
enRole.properties.
CTGIMD060E An error occurred searching the ITIM
directory for a matching person: Entry
name entry_name, Container
org_tree_container.
Explanation: An attempt to search the ITIM directory
to locate a match for the specified identity feed entry
name resulted in an error. This was probably due to an
invalid format being specified for the entry name.
Administrator response: Correct the entry name. If
the name looks valid, review the IBM Security
Privileged Identity Manager log files to identify the
actual original error message.
CTGIMD061E The connection to the remote adapter
failed. The request will be retried
periodically.
Explanation: Due to a connection failure to the
adapter, this service is marked as failed. This request
and potentially others will be retried once the
connection with the adapter is restored. Future requests
to this adapter will also be in this state until the
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD070E • CTGIMD107E
connection issue is corrected.
User response: If this request is urgent, please contact
your system administrator and ask them to
troubleshoot the connection problem with the service.
The request will be retried at a future date.
Administrator response: There is connection problem
between the Identity Manager server and the remote
adapter. The error could arise from multiple issues. For
example: network problem, service configuration
problem, adapter configuration problem, or Directory
Integrator failure. For details of the failure and more
information about other requests that might be blocked
for this service, use the administrative console and
navigate to 'Manage Services' and search for services in
the failed state. Click the status icon to get more
information on the status of the service. Once the
necessary changes have been made (either in the
Identity Manager system, or on the remote endpoint),
you can 'Restart Blocked Requests' from the 'Manage
Services' panel. This action retries the connection to the
remote adapter and if successful, retries any blocked
requests for the service.
CTGIMD070E The account_name account already
exists.
CTGIMD102E The attribute_name attribute is not
valid.
Explanation: The attribute value passed to the adapter
is not correct. For example, the data type pass is not
expected.
Administrator response: Verify the correct service
profile is being used for the adapter.
CTGIMD103E The attribute_name configuration
attribute is not valid.
Explanation: The adapter configuration information is
not correct or does not match the adapter.
Administrator response: Review the service profile
definition form to determine if the values are correct. If
the profile is not customized request an updated
service profile that matches the current adapter.
CTGIMD104E The filter_data reconciliation search
filter is not valid.
Explanation: The adapter returned an error while
processing the search filter provided on the
reconciliation request.
Explanation: An attempt has been made to add an
account that already exists. This can occur due to race
conditions, where two simultaneous attempts are made
to add the same account, such as two administrators
creating the same account at the same time.
Administrator response: Correct the search filter that
is specified on the reconciliation filter in the user
interface.
Administrator response: If due to a race condition,
verify the existing account is correct.
Explanation: The adapter returned an
InvalidNameExpection exception.
CTGIMD071E The account_name account does not
have a password attribute.
Explanation: The password of an account cannot be
changed if the account does not have a password
attribute.
CTGIMD100E The adapter returned an
authentication error.
Explanation: The credentials used to establish a
session with the adapter contains an error.
Administrator response: Check the credentials
specified on the service form.
CTGIMD101E A connection with the adapter cannot
be established. The following error
occurred. Error: error_text
Explanation: An error occurred while establishing a
connection with the adapter.
Administrator response: Check for network problems.
CTGIMD105E
The name name is not valid.
Administrator response: Review the adapter log files
for additional information about the error.
CTGIMD106E An error occurred while processing
the request. Error: error_text
Explanation: The adapter returned a JNDI error not
handled by the IBM Security Privileged Identity
Manager server.
Administrator response: Review the error text for
details. Review the adapter log files for additional
information.
CTGIMD107E The entry_name entry name is not
found.
Explanation: The user specified on the request to the
adapter does not exist. This can happen when accounts
are deleted from the adapter not using the IBM
Security Privileged Identity Manager interface.
Administrator response: Specify a name that currently
exists.
Messages
39
CTGIMD108E • CTGIMD117E
CTGIMD108E The attribute_name attribute is not a
valid attribute.
Explanation: The adapter does not recognized the
attribute.
Administrator response: Verify that the correct service
profile is being used for the adapter.
CTGIMD109E The operation_name operation is not
supported.
Explanation: An internal error occurred. The service
provider passed an operation code value that is not
valid.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
more of the attribute values. This could be due to an
incorrect value being passed for the attribute or the
value being passed in an attribute that the adapter is
not configured to support.
Administrator response: Correct the incorrect attribute
values and try the operation again.
CTGIMD114E An internal error occurred. The JNDI
Context parameter is missing.
Explanation: An internal error occurred. A null JNDI
Context parameter was passed to the directory provider
request handler.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD115E
CTGIMD110E The password field is missing from a
request that requires a password.
Explanation: An internal error occurred. The
password attribute is missing from the request to the
adapter.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD111E The maximum size limit has been
reached processing a reconciliation
request.
Explanation: The reconciliation search result is greater
than what the adapter can handle.
The tenant cannot be found.
Explanation: An internal problem occurred retrieving
the tenant property information from the
enRole.properties file. Or, an directory server error
occurred looking up the tenant object.
Administrator response: Check that the tenant related
properties in enRole.properties file are correct. Review
the values for the enrole.defaulttenant.id and
enrole.ldapserver.root properties. Review the directory
server log files for additional information about the
error.
The protocol module had a problem retrieving the
Tenant property information from the enRole.properties
file, or an LDAP error occurred looking up the tenant
object to find its DN.
CTGIMD116E
The naming attribute is missing.
Administrator response: Reconfigure adapter to allow
more results to be returned.
Explanation: The name attribute is missing from the
entity configuration for the account or person being
used by the adapter.
CTGIMD112E The time limit expired processing a
reconciliation request.
Administrator response: Check that the Entity
Configuration page contains a value for the name
attribute.
Explanation: The reconciliation request did not
complete before the maximum time limit configured on
the adapter.
Administrator response: Reconfigure the adapter to
allow queries to run for a longer time.
CTGIMD117E The following IO exception occurred
communicating with the IBM Tivoli
Directory Integrator adapter. Error:
error_text
Explanation: See message.
CTGIMD113E The request was successfully
processed but some of the values for the
attribute_name attribute cannot be
changed.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
Explanation: The adapter was unable to change one or
40
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD118E • CTGIMD127E
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD118E An error occurred while processing a
response from the IBM Tivoli Directory
Integrator adapter. Error: error_text
Explanation: An internal error occurred.
Administrator response: Check the version of the IBM
Tivoli Directory Integrator to verify it is compatible
with the IBM Security Privileged Identity Manager.
Check the IBM Tivoli Directory Integrator log files for
additional information about the errors.
Error unmarshalling response from ITDI managed
resource.
CTGIMD119E A model communication error
occurred. The following error occurred.
Error: error_text
CTGIMD122E
The message format is not valid.
Explanation: The response message received from the
IBM Tivoli Directory Integrator adapter is not the
correct format.
Administrator response: Check the version of the IBM
Tivoli Directory Integrator to verify that it is compatible
with the IBM Security Privileged Identity Manager.
Review the IBM Tivoli Directory Integrator log files for
additional information about the errors.
CTGIMD123E The test request failed. Result code:
result_code Error: error_text
Explanation: The service returned an error to the Test
request.
Administrator response: Confirm service
configuration parameters are correct. Review the IBM
Tivoli Directory Integrator log files for additional
information about the errors.
Explanation: An internal processing error occurred.
Administrator response: Check the IBM Security
Privileged Identity Manager log files for additional
information about the errors. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD120E The object_name object cannot be
found.
Explanation: An error occurred locating the mapped
attribute name for the password or the object in the
adapter data storage.
Administrator response: Check the adapter log files
for additional information about the errors. Check IBM
Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD121E An error occurred while processing a
request for the adapter. The following
error occurred. Error: error_text
Explanation: A Runtime exception occurred
processing an adapter request.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. Check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD124E The value for the naming_context
Naming Context is not supported for the
IBM Tivoli Directory Integrator adapter.
The valid Naming Context values for
the adapter are: supported_naming_context.
Explanation: The Naming Context value on the
service definition form is not one of the supported
values for the IBM Tivoli Directory Integrator adapter.
Administrator response: Correct the value for the
service configuration Naming Context field.
CTGIMD125E
Can't find object profile for entity.
Explanation: Object profile not found for entity.
Administrator response:
CTGIMD126E The following IO exception occurred
communicating with CSV File. Error
message: error_text
Explanation: IO exception occurred while
communicating with CSV file.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about error.
CTGIMD127E Error while closing the connection
with remote resource:cause cause
Explanation: Exception occurred while closing the
connection with remote resource.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about error.
Messages
41
CTGIMD128E • CTGIMD143E
CTGIMD128E Error occurred while performing
operation operation_name : cause cause
Explanation: Error occurred while performing add,
delete, change password, modify operations.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about error.
CTGIMD129E Invalid CSV entry at line line_number
: number of columns (number_of_columns)
in the CSV file.
Explanation: Invalid CSV entry into the CSV file.
Administrator response: Check for CSV entry at line
number specified in log.
CTGIMD130E The name attribute name_attribute
cannot be obtained for the entry_name
entry from the returned entry attributes.
Explanation: The data sent from the agent for the
reconciliation did not contain a value for the name
attribute.
Administrator response: Make sure the name attribute
is correct in the service configuration data. Correct any
user entries on the resource that do not contain a value
for this attribute.
The entry attribute list for an entry sent by the agent
did not contain a value for the name attribute (as
configured in the service definition screen). The entry
name parameter displayed is the entry name (dn)
returned by the resource.
CTGIMD131E Could not remove profile because
service instance for the profile
profile_name exists.
Explanation: Unable to remove profile because a
service instance of profile exists.
Administrator response:
CTGIMD140E All number_failed_entries reconciliation
entries failed.
Explanation: Every entry processed by the
reconciliation failed.
Administrator response: See message and trace logs
for detailed messages.
CTGIMD141E An error occurred processing
number_failed_entries of
total_number_entries reconciliation entries.
Explanation: An error occurred processing one or
more reconciliation entries.
42
Administrator response: See message and trace logs
for detailed messages.
CTGIMD142E The page size property in service
profile service_profile_name is set to a
disallowed value ('page_size_value'). The
value must be an integer. Note: values
which are less than or equal to zero will
disable paging for searches. (Default=0)
Explanation: The page size property
('com.ibm.itim.feed.pagesize') used by the LDAP and
Active Directory person feed adapters specifies the
page size used to page search results. The value must
be specified as an integer. If the value of this property
is not set or is less than or equal to zero then paging
will be disabled for searches. Some directory servers do
not support paging and paging might cause a
performance impact on those servers that do support it
so caution should be exercised when using paging.
Microsoft's Active Directory has a single page limit of
1000 entries and so paging is necessary for search
results containing more the 1000 entries. Note: the AD
person feed profile sets the page size to 100 when
Identity Manager is initially installed.
System action: Paging will be disabled until the
property value is corrected. On some directories such
as Microsoft's Active Directory this might cause search
results over a specified limit to fail or return partial
results.
Administrator response: Use a LDAP browser to set
the com.ibm.itim.feed.pagesize property of the specified
service profile to an integer value or remove the
property to disable paging.
The service profile page size property
('com.ibm.itim.feed.pagesize') is used to specify to use
LDAP paging for searches via the Service Provider
com.ibm.itim.remoteservices.provider.feedx.DirectoryServiceProvider.
This is required for some LDAP Directories, such as
Windows AD, to return a large number of results.
Enabling paging increases LDAP server memory usage,
and might limit the number of concurrent searches
allowed, so should only be used when necessary.
CTGIMD143E The reconciliation of a manual
service failed due to an invalid account
header on line line_number of the CSV
file. Every entry processed by the
reconciliation failed.
Explanation: The header line must contain at least the
required attributes for the account type.
Administrator response: The account header line
must contain all required attributes defined in the
account definition for the service type. Check the
format of the CSV file used for reconciliation, make
required updates and try the recon again. See the
message and trace logs for detailed messages. The
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD145E • CTGIMD805E
formatting rules for the CSV file can be found in the
Infocenter.
CTGIMD145E The reconciliation of a manual
service failed due to unknown
objectprofile in the group header on
line line_number of the CSV file. Every
entry processed by the reconciliation
failed. The line with the group delimiter
(group_delimiter) must contain a valid
group objectprofile. The data provided
was not valid: provided_data.
Explanation: The group definition line must contain
an existing objectprofile for the group schema. The
objectprofile name will usually end with GroupProfile.
Administrator response: See the message and trace
logs for detailed messages. Check format of
reconciliation file to ensure it is correct and try again.
The formatting rules for the CSV file can be found in
the Infocenter.
CTGIMD146E The reconciliation of a manual
service failed because there was no data
in the CSV file that was uploaded.
Explanation: The reconciliation CSV file uploaded for
this manual service was empty.
Administrator response: Choose a reconciliation CSV
file that contains data and try again. The formatting
rules for the CSV file can be found in the Infocenter.
CTGIMD801E An error occurred while retrieving
the results from a reconciliation. Error:
exception_text
Explanation: An exception occurred while retrieving
the result list from a reconciliation response.
Administrator response: Review the IBM Security
Privileged Identity Manager and adapter log files for
additional information about the error.
NamingException received by
SearchResponseEnumeration method
CTGIMD802E The service definition is missing the
URL value for the host.
Explanation: The Host URL field is blank on the
service definition form for the adapter.
Administrator response: Correct the Host URL field
value in the service definition field.
Host URL not specified in DAML protocol parameter
java.naming.provider.url
CTGIMD803E The protocol portion of the Host URL
field value is not valid. URL: url
Explanation: The protocol portion of the URL does
not contain http or https.
Administrator response: Correct the Host URL field
value in service definition form.
Host URL invalid in DAML protocol parameters
CTGIMD147E The reconciliation of a manual
service failed because no group attribute
names were provided in the group
header on line line_number in the CSV
file that was uploaded.
Explanation: The CSV file containing group
information had an invalid group header line. The
header line must have one or more attribute names
specified.
Administrator response: See the message and trace
logs for detailed messages. Check the format of the
reconciliation CSV file to ensure that it is correct and
try again. The formatting rules for the CSV file can be
found in the Infocenter.
CTGIMD800E An IO exception occurred while
connecting to the adapter using the
following URL. URL: URL Error:
error_text
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager and adapter log files for
additional information about the error.
CTGIMD804E An IO error occurred while sending a
request. Error: error_text
Explanation: An IO Exception occurred while sending
a request to the adapter.
Administrator response: Verify that the adapter
service is started and the adapter configuration is
correct. Review the IBM Security Privileged Identity
Manager and adapter log files for additional
information about the error.
CTGIMD805E The compare of data in the directory
structure cannot be completed. An
internal error occurred because the filter
value passed by the code is not correct.
Value: compare_expression
Explanation: An internal request to perform a LDAP
comparison failed. The filter value specified for the
comparison is not correct. The calling code did not pass
the expected values.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Messages
43
CTGIMD806E • CTGIMD813E
The LDAP compare call (used for the password verify
function of self-claim) specified an incorrect filter value.
Expecting Attribute Value Assertion using
EqualityMatch, such as (erpassword=passwordvalue).
CTGIMD806E The adapter does not support
password synchronization.
Explanation: The compare operation to perform
password synchronization did not complete. The
adapter does not support the Compare operation, used
for the password verify function of self-claim.
Administrator response: The resource software level
is not current, upgrade the adapter to a newer version.
The resource does not support the LDAP Compare
operation. This operation is required for self-claim.
Note, for DAML agents this feature was added in ADK
version 4.63.
CTGIMD807E An error occurred while processing
the operation_code JNDI modify request.
Explanation: An internal process issued an incorrect
JNDI modify request.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMD809E An IO error occurred while reading a
response message. The following error
occurred. Error: error_text
Explanation: An IO Exception occurred while reading
a response from the adapter.
Administrator response: Review the IBM Security
Privileged Identity Manager and adapter log files for
additional information about the error.
CTGIMD810E The adapter returned an error status
for a REQUEST_TYPE request. Status
code: STATUS_CODE Adapter error
message: error_message
Explanation: The protocol module or adapter returned
an error message.
Administrator response: Review the adapter error
message for details. Review the adapter log files for
additional information about the error.
CTGIMD811E The adapter returned an
unrecognized result status code for a
REQUEST_TYPE request. Status code:
STATUS_CODE Adapter error message:
error_message
Explanation: An unrecognized error status was
returned by the protocol module or by the adapter. The
IBM Security Privileged Identity Manager server will
not do any special processing based on the status code.
The modification operation code, specified in a JNDI
modifyAttributes method call, was invalid. Expecting
one of:
javax.naming.directory.DirContext.ADD_ATTRIBUTE,
.REPLACE_ATTRIBUTE, .REMOVE_ATTRIBUTE.
Administrator response: Review the adapter error
message for details about the error received from the
adapter. Review the adapter log files for additional
information about the error.
CTGIMD808E An internal request to perform a
JNDI search is not valid. Search control
scope: scope_value
CTGIMD812E An error occurred while processing
the adapter response message. The
following error occurred. Error:
error_message
Explanation: An internal error occurred performing a
JNDI search. An attribute provided for the search
request is not valid.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
The search control scope, specified in the
SearchControls parameter to a JNDI search method call,
was invalid. Expecting one of:
javax.naming.directory.SearchControls.OBJECT_SCOPE,
.ONELEVEL_SCOPE, .WHOLE_SUBTREE_SCOPE.
Explanation: A parsing error occurred while reading a
response from the adapter. The adapter returning badly
formatted data, such as returning non-character data,
can cause this problem. It can also be caused by
network failure, adapter failure or adapter machine
failure in the middle of a response being sent.
Administrator response: Review the adapter log files
for additional information about the error.
CTGIMD813E An error occurred while connecting
to an adapter. The following error
occurred. Error: error_text
Explanation: The SSL Library detected an error
connecting to the adapter.
Administrator response: Review the IBM Security
Privileged Identity Manager and adapter log files for
44
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD814E • CTGIMD820E
additional information about the error.
The connect method received an Exception from the
SSL library.
CTGIMD814E The cipher_suites_list cipher suites list
value is not valid.
Explanation: The value for the
com.ibm.daml.jndi.DAMLContext.HTTPS_CIPHERSUITES
property contains one or more names for SSL cipher
suites that are not available. The property is defined in
the enRole.properties file.
Administrator response: Review the list of configured
SSL cipher suites for the JSSE Provider. To view the list,
verify that the trace logging level is set at DEBUG_MID
or higher for the
com.ibm.daml.jndi.JSSESocketConnection category.
Restart the IBM Security Privileged Identity Manager
Server if you needed to change the logging level. Issue
a test to the adapter. The trace.log file will contain the
list of supported cipher suites when the first connect to
the adapter is issued. The list is under the supported
cipher suites character string.
Identity Manager trust store for a list of trusted issuers.
CTGIMD817E The agent SSL certificate is expired
or not yet valid.
Explanation: The agent certificate validity dates do
not include the current date. These are specified in the
certificate not before and not after fields. Note that
these fields specify universal (UT) time and not local
time.
Administrator response: Verify that the clocks on the
peer and IBM Security Privileged Identity Manager
server machines are correct. If the certificate has
expired, a new certificate must be issued for the agent.
CTGIMD818E The adapter host name host_name
does not match the name cert_host_name
specified in the adapter certificate.
Explanation: The certificate received does not belong
to the adapter. The SSL peer name verification is
enabled and the name specified on the certificate does
not match the name of the host.
The connect method received an Exception from the
SSL library.
Administrator response: If peer host name validation
is enabled via the
com.ibm.daml.jndi.DAMLContext.VERIFY_PEER_CERT_NAME
property in the enRole.properties file, then the name
specified in the Subject field on the certificate under the
common name (CN) component must match the name
of the adapter host. The name of the adapter host is
obtained by issuing a Domain Name Service (DNS)
lookup on the address part of the adapter Host URL
field that is specified in the service definition. There
might also be a problem with the DNS configuration on
the machine running the IBM Security Privileged
Identity Manager server causing the DNS lookup to
fail. Ensure that a valid certificate is issued with the
correct CN component value, or turn off the peer name
verification function.
CTGIMD816E The server certificate for the SSL
peer (adapter) cannot be validated.
CTGIMD819E The jsse_provider_name JSSE provider
is not installed.
Explanation: The IBM Security Privileged Identity
Manager has rejected the peer (adapter) SSL server
certificate. There are a number of reasons the certificate
cannot be verified: The server certificate is issued by an
authority that is not in the IBM Security Privileged
Identity Manager's list of trusted authorities. The
certificate has expired. The certificate is not yet valid.
Explanation: The
com.ibm.daml.jndi.JSSESocketConnection.JSSE_PROVIDER
property in enRole.properties file does not specify the
name of an installed JSSE Provider. If the JSSE provider
property is not specified, then neither of the default
JSSE providers (IBMJSSE or SunJSSE) is installed.
The list of required cipher suites contains a name that
is either not supported or not valid for the configured
JSSE provider.
CTGIMD815E An IO exception occurred in the SSL
library while closing a connection.
Explanation: The SSL Library detected an error closing
the connection to the adapter.
Administrator response: Review the IBM Security
Privileged Identity Manager and adapter log files for
additional information about the error.
Administrator response: Ensure that the adapter SSL
server certificate is valid. Also, verify that the issuer of
the server certificate is imported into the server known
certificate authority list using the iKeyMan tool or
similar. Review the IBM Security Privileged Identity
Manager trace log for further details.
The SSL library had a problem trying to verify the
peer's certificate. Either it's expired, not yet valid, or the
issuer is not trusted. See the IBM Security Privileged
Administrator response: Correct the value or install
the required JSSE provider into the Java Virtual
Machine (JVM).
CTGIMD820E The value specified for the
com.ibm.daml.jndi.DAMLContext.CA_CERT_DIR
property is not valid. The path is not
valid or does not contain a valid CA
certificate.
Messages
45
CTGIMD821E • CTGIMD829E
Explanation: The
com.ibm.daml.jndi.DAMLContext.CA_CERT_DIR
property specifies a path that is not valid or does not
contain any valid CA certificates. Note that this
property is no longer available on newer adapter
service definitions. The preferred way to install issuer
(CA) certificates is to install them into the IBM Security
Privileged Identity Manager server Trust Store.
Administrator response: Verify that the value is valid.
The property can be specified in either the CA path
field on the service definition form or in the
enRole.properties file.
CTGIMD821E The certificate is not a certificate
authority certificate (issuer certificate).
The certificate is ignored.
Explanation: A certificate in the path specified by the
com.ibm.daml.jndi.DAMLContext.CA_CERT_DIR
property is not a valid issuer (CA) certificate.
Administrator response: Specify a correct issuer
certificate.
X.509v3 certificate basicConstraints extension indicate
this is not a CA certificate
CTGIMD824E
The SSL initial handshake failed.
Explanation: A common set of SSL configuration
settings with the peer cannot be negotiated.
Administrator response: Review the IBM Security
Privileged Identity Manager server and adapter log
files for additional information about the error. Verify
both server and adapter have valid SSL configuration
settings.
CTGIMD825E An error occurred obtaining the
default key manager for algorithm:
algorithm_name
Explanation: An internal error occurred using the
default algorithm to locate the default key manager.
Administrator response: Review the IBM Security
Privileged Identity Manager server log files for
additional information about the error.
CTGIMD826E An error occurred locating the default
trust manager for algorithm:
algorithm_name
Explanation: An internal error occurred using the
default algorithm to locate the default trust manager.
CTGIMD822E The peer certificate is not Trusted.
Unable to establish a SSL connection.
Peer address: host_name_and_port SSL
error: ssl_error_message
Administrator response: Review the IBM Security
Privileged Identity Manager server log files for
additional information about the error.
Explanation: The peer SSL certificate (used by the
adapter) is not issued by one of the issuers listed in our
Trust Store and cannot be trusted.
CTGIMD827E The http_header in the HTTP response
line is not valid.
Administrator response: Add the issuer (signer)
certificate that issued the peer certificate to the IBM
Security Privileged Identity Manager server Trust Store.
CTGIMD823E The peer does not trust the IBM
Security Privileged Identity Manager
server client certificate. A SSL
connection using mutual authentication
cannot be establish.
Explanation: The peer (adapter) requested our client
certificate to establish a mutually authenticated SSL
connection, but the IBM Security Privileged Identity
Manager server key store does not contain a client
certificate issued by one of the peers trusted authorities.
Administrator response: Add the issuer (signer)
certificate that issued the IBM Security Privileged
Identity Manager server client certificate to the adapter
list of trusted issuers.
Explanation: The first line of the HTTP response
message is not valid.
Administrator response: Confirm the URL is pointing
a valid adapter using the DAML protocol. Review the
adapter log files for additional information.
CTGIMD828E The end of file occurred before the
entire HTTP header was received.
Explanation: The input stream was closed by the
remote resource before the complete HTTP header was
received.
Administrator response: Confirm the URL is pointing
a valid adapter using the DAML protocol. Review the
adapter log files for additional information.
CTGIMD829E The content_length_value value for the
HTTP content-length header is not
valid.
Explanation: The value of the HTTP content-length
header is not valid. A positive decimal integer value is
expected.
Administrator response: Confirm the URL is pointing
46
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD830E • CTGIMD867E
a valid adapter using the DAML protocol. Review the
adapter log files for additional information.
CTGIMD830E The chunk_length_value value for the
HTTP chunk length is not valid.
Explanation: The value of the HTTP chunk length
field, used when chunked encoding is being used, is
not valid. A hexadecimal value string is expected.
Administrator response: Confirm the URL is pointing
a valid adapter using the DAML protocol. Review the
adapter log files for additional information.
CTGIMD831E The host name portion of the Host
URL field value is not valid. Hostname:
url
Explanation: The host name portion of the URL is not
known to the DNS server.
Administrator response: Correct the Host Name field
value in service definition form.
Host name in host URL field of DAML protocol
parameters (from service definition form) resulted in a
DNS lookup error.
CTGIMD851E A value for the Naming Context field
is required for the service definition.
Explanation: See message.
Administrator response: Specify a value for the
Naming Context field value in the service definition.
CTGIMD852W Ignoring defer failed agent requests
option for service service_name : not
supported for ERMA Protocol agents.
Explanation:
Administrator response:
CTGIMD860E Error initializing DSML Parser:
parser_error_message.
Explanation: An error occurred trying to initialize the
XML parser. See the specified error text for details.
Administrator response: Correct the error as
described in the error text.
CTGIMD861E XML Parsing error:
parser_error_message at location
(:line:column) line_column_number.
Explanation: The XML parser reported an error. See
the specified error text for details.
Administrator response: Correct the error as
described in the error text.
CTGIMD862E Element tag tag_name is not allowed
within tag tag_name at location
(:line:column) line_column_number.
Explanation: An inner tag name was found within an
outer tag that does not support it.
Administrator response: Correct the tag nesting
structure of the DSML file.
CTGIMD863E Invalid element tag tag_name at
location (:line:column)
line_column_number.
Explanation: An unknown tag name was found.
Administrator response: Correct the tag name.
CTGIMD864E End element tag tag_name does not
match current element tag tag_name at
location (:line:column)
line_column_number.
Explanation: An unexpected end tag name was found.
The end tag name should match the current opening
tag name.
Administrator response: Correct the name of the end
tag.
CTGIMD865E Mandatory attribute attribute_name
not found in tag tag_name at location
(:line:column) line_column_number.
Explanation: A mandatory attribute is missing from
the specified tag name.
Administrator response: Add the required attribute to
the tag name in the DSML file.
CTGIMD866E attr name=objectclass invalid; you
must use objectclass tag instead at
location (:line:column)
line_column_number.
Explanation: The attribute name objectclass cannot be
used in an attr tag. Instead, you must use the
objectclass tag.
Administrator response: Correct the syntax used for
objectclass in the DSML file.
CTGIMD867E Invalid DSML file name
dsml_File_Name
Explanation: The specified file name is invalid or
missing.
Administrator response: Correct the DSML file name
field to point to an existing file.
Messages
47
CTGIMD868E • CTGIMD878E
CTGIMD868E DSML file name dsml_File_Name not
found.
Explanation: The specified DSML file name does not
exist.
Administrator response: Correct the DSML file name
field to point to an existing file.
CTGIMD870E Element element_name is not allowed
within element outer_element_name at
resource.def location (:line:column)
line_column_number
Explanation: The specified resource.def XML element
is incorrectly nested within an outer element that does
not support this element. The location indicates where
the not allowed element is within the resource.def file.
Administrator response: Correct the syntax of the
resource.def file.
CTGIMD874E No AccountDefinition found
matching ServiceDefinition
AccountClass= class_name at resource.def
location (:line:column)
line_column_number
Explanation: There is no AccountDefinition element
with a ClassName attribute value matching the
specified ServiceDefinition element AccountClass
attribute value in the resource.def file.
Administrator response: Correct the account class
name for the two elements in the resource.def file.
CTGIMD875E Invalid value attribute_value for
element element_name attribute
attribute_name at resource.def location
(:line:column) line_column_number
Explanation: The specified resource.def attribute has
an invalid value. The location indicates where the
invalid value is within the resource.def file.
CTGIMD871E Invalid element name element_name at
resource.def location (:line:column)
line_column_number
Administrator response: Correct the attribute value in
the resource.def file.
Explanation: The specified resource.def XML element
is invalid. The location indicates where the invalid
element is within the resource.def file.
CTGIMD876E IBM Security Privileged Identity
Manager cannot create the group.
Administrator response: Correct the element name in
the resource.def file.
Explanation: The service has a reconciliation in
progress and is currently locked. The group cannot be
created while the service is in this state.
CTGIMD872E End Element end_element_name does
not match current element
current_element_name at resource.def
location (:line:column)
line_column_number
Explanation: The specified resource.def end element
name does not match the current start element name.
The location indicates where the end element is within
the resource.def file.
Administrator response: Correct the end element
name in the resource.def file.
CTGIMD873E Mandatory attribute attribute_name
not found or has empty value in
element element_name at resource.def
location (:line:column)
line_column_number
Explanation: The specified resource.def mandatory
attribute is missing, or has an empty value, for the
specified element. The location indicates where the end
of the element with the missing attribute is within the
resource.def file.
Administrator response: Add the missing attribute
with a non-empty value to the element in the
resource.def file.
48
Administrator response: Create the group after the
reconciliation is completed and the service is again
available.
CTGIMD877E The operation create group has timed
out.
Explanation: The operation create group has a time
limit associated with it. The operation has exceeded the
time limit and stopped.
Administrator response: Increase the time limit value.
Perform these steps: Update the property
com.ibm.itim.remoteservices.ejb.mediation.SynchronousGroupActions.GROUP_ACTION_TIMEOUT
in enrole.properties by increasing the value.
CTGIMD878E The operation delete group has timed
out.
Explanation: The operation delete group has a time
limit associated with it. The operation has exceeded the
time limit and stopped.
Administrator response: Increase the time limit value.
Perform these steps: Update the property
com.ibm.itim.remoteservices.ejb.mediation.SynchronousGroupActions.GROUP_ACTION_TIMEOUT
in enrole.properties by increasing the value.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMD879E • CTGIME012E
CTGIMD879E The operation modify group has
timed out.
Explanation: The operation modify group has a time
limit associated with it. The operation has exceeded the
time limit and stopped.
Administrator response: Increase the time limit value.
Perform these steps: Update the property
com.ibm.itim.remoteservices.ejb.mediation.SynchronousGroupActions.GROUP_ACTION_TIMEOUT
in enrole.properties by increasing the value.
Policy messages
CTGIME001E
An unexpected error occurred while
processing a policy authority request.
The following error occurred. Error:
error_text
CTGIME006E
Explanation: The policy authority request cannot
complete because of an error.
Administrator response: Review the exception stack
trace in the error log file for additional information
related to the error.
CTGIME002W Multiple governing policies with the
names of policy_names exist for the same
service.
Explanation: More than one policy was found for the
same service. This message applies to the Password
and Service Selection policies. Using the IBM Security
Privileged Identity Manager console to define policies
prevents this condition from occurring. The problem
may occur as a result of raw policy data import.
System action: The first policy returned from the
search will be used. There is no guarantee which policy
is returned first.
Administrator response: Remove the duplicate policy
from the directory server. If problem continues or is not
the results of a data import or modification to the IBM
Security Privileged Identity Manager code, check IBM
Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman to determine the source of
the problem.
CTGIME004E
The service_name service is not in the
scope of the host_policy_name host
selection policy and povision_policy_name
provisioning policy for person_name.
Explanation: A service returned from the service
selection evaluation script is not within the scope of the
provisioning policy governing the service selection.
Administrator response: Verify that the service
instance calculated by the script falls within the
coverage of the correct provisioning policy.
An error occurred while evaluating a
service selection script. The script may
contain a coding error. Script was being
evaluated in the following context:
Policy name: policy_name Target name:
target_name Person name: person_name
Explanation: An error occurred while processing the
script. The script may contain a coding error.
Administrator response: Review the script code for
coding errors. Make the appropriate changes and try
the operation again.
CTGIME010E
An error occurred parsing the XML
containing password rules. The
following error occurred. Error: error_text
Explanation: An error occurred while parsing an XML
representation of an password rule object. The
password rule object may contain corrupted data.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIME011E
A conflict was detected while joining
password rules. Information: detail_data
Explanation: A password rule conflict was detected
when joining all the governing password rule values
for an account. Two or more of the password rules are
mutually exclusive.
Administrator response: Review the password rules
that are being joined for the account. Make any
required changes to the set of rules to ensure that the
rules do not have conflicting requirements.
CTGIME012E
The password does not meet the
requirements of the password rule. The
following error occurred. Error: error_text
Explanation: The password violates the password
rules for the account.
Administrator response: The owner of the account
should change the password to satisfy the password
rules or ask the ITIM administrator to modify the
password rules.
Messages
49
CTGIME013E • CTGIME021E
CTGIME013E
A problem occurred evaluating a
script based provisioning parameter for
the policy_name policy. Policy DN:
policy_dn Attribute name: attribute_name
Attribute value: attribute_value Error:
error_text . Enter valid javascript for
Attribute name: attribute_name.
Explanation: A script based provisioning parameter
value cannot be evaluated because of a runtime error
condition.
Administrator response: Review the error text and
make the appropriate corrections before trying the
request again.
CTGIME014E
A number format error occurred
while evaluating the account. Account:
account_uid Attribute: attr_name
Explanation: The value for the attribute is not correct.
Administrator response: Check that the data type is
correct for the provisioning parameters. Review the
IBM Security Privileged Identity Manager log files for
additional information about the error.
outages, and try the operation again. Review the IBM
Security Privileged Identity Manager log files for
additional information related to the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIME018E
Explanation: The directory server schema could not be
retrieved.
Administrator response: Verify that the directory
server is available and that there are no network
outages, and try the operation again. Review the IBM
Security Privileged Identity Manager log files for
additional information related to the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIME019E
CTGIME015E
An error occurred while processing
policy analysis request. The following
error occurred. Error: error_text
Explanation: The policy analysis request did not
complete because of an unexpected error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information related to the error.
CTGIME016E
An error occurred while searching for
an entity. The following error occurred.
Error: error_text
Explanation: A data integrity error occurred
preventing a successful look up of an entity from the
database.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information related to the error.
CTGIME017E
An error occurred while attempting to
establish communication with the
directory server. The following error
occurred. Error: error_text
Explanation: A communication error occurred when
the system attempted to access a directory server,
which is not accepting connections. Possible reasons
include the directory server is down or overloaded
with requests.
The schema entry cannot be found in
the directory server. The following error
occurred. Error: error_text
Explanation: A schema entry cannot be looked up on
the directory server.
Administrator response: Verify that the directory
server is available and that there are no network
outages, and then try the operation again. Review the
IBM Security Privileged Identity Manager log files for
additional information related to the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIME021E
The search results did not return all
the required information. The following
error occurred. Error: error_text
Explanation: Not all the expected results were
returned from the directory server search.
Administrator response: Verify that the directory
server is available and that there are no network
outages, and try the operation again. Review the IBM
Security Privileged Identity Manager log files for
additional information related to the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
Administrator response: Verify that the directory
server is available and that there are no network
50
An error occurred retrieving the
directory server schema. The following
error occurred. Error: error_text
IBM Security Privileged Identity Manager: Error Message Guide
CTGIME022W • CTGIME035E
CTGIME022W The policy_dn provisioning policy
cannot be found.
CTGIME031E
Explanation: The policy cannot be found during
internal processing.
Explanation: The specified account cannot be found in
the directory server. Either the account is not defined or
has been deleted.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information related to the error.
CTGIME025E
The requested service cannot be
found in the directory server. The
following error occurred. Error: error_text
Explanation: The service entity data cannot be found
in the directory server. The service entity entry has
been removed from the directory but references to it
still exist in currently executing server code.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information related to the error.
CTGIME026E
The requested service profile cannot
be found in the directory server. The
following error occurred. Error:
service_dn
Explanation: A service profile data cannot be found in
the directory server. This condition can be the result of
a service profile entry being removed from the
directory but references to it still exist in currently
executing server code.
The account cannot be
found.account_name
Administrator response: Define the missing account if
appropriate. If the account should not exist, no action is
required.
CTGIME032E
An error occurred creating the
analysis unit. The following error
occurred. Error: error_text
Explanation: The analysis unit cannot be created
because of an error. While segmenting the policy
change analysis work unit into smaller units an error
occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information related to the error.
CTGIME033E
An unsupported analysis reason was
detected during policy analysis. Reason
type: reason_type
Explanation: The reason type indicated in the message
is not supported. An abnormal internal condition
occurred analyzing policy changes producing an reason
code that is not valid.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information related to the error.
Administrator response: An internal processing error
occurred. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIME029E
CTGIME034E
The following policies cannot be
compared. Policy 1: policy1 Policy 2:
policy2
Explanation: During policy change analysis, old and
new policy objects do not reference the same
distinguished name and cannot be compared.
Administrator response: This error may indicate a
data integrity problem and should be looked at by a
system administrator.
CTGIME030E
Cyclical dependency was detected
during service prerequisite resolution:
cycleInfo
Explanation: This error indicates that resolution of
service prerequisite dependencies is impossible due to
cyclical dependencies.
Administrator response: Affected services should be
analyzed and the cycles resolved before retrying the
request.
The person person_name cannot be
found in the directory server.
Explanation: A request to located the specified person
failed. The person name is missing from the directory
server. The message may be the result of the person
entry being removed from the directory but not all
processing requests related to the entry have
completed.
Administrator response: Check that the person should
not be in the directory. If the problem persists, check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIME035E
The following script evaluation error
occurred. Error: error_text
Explanation: An error occurred while processing the
script. The script may contain a coding error.
Administrator response: Review the script code for
coding errors. Make the appropriate changes and try
the operation again.
Messages
51
CTGIME036E • CTGIME203E
CTGIME036E
The maximum number of attempts
for generating a valid password was
exceeded. The maximum number of
retries is maximum_number_retries
Explanation: A request to generate a new password
cannot complete. The maximum number of attempts
has been reached. The password rules may be too
restrictive to generate a strong password.
Administrator response: Review the password rules
associated with the account to ensure they are not too
restrictive. A too restricted set of password rules will
prevent the system from generating a random
password within allowed number of attempts.
CTGIME037E
There was an error creating a
prerequisite account. The person is not
entitled to one of the prerequisite
services.
Explanation: A request to provision a service for a
person failed because the person is does not have the
authorization for one of the prerequisite services. To
complete the service provisioning the person must be
authorized for all prerequisites associated with the
service.
Administrator response: Verify that all prerequisite
accounts are setup for the person.
CTGIME038E
The global service compliance setting
cannot be found. The following error
occurred. Error: error_text
Explanation: A global compliance setting cannot be
obtained from system configuration settings. Either the
setting was not specified during configuration or there
is a problem retrieving the information.
Administrator response: Verify that the global
compliance setting has been configured. If the setting is
configured, verify that access to the directory server is
available.
CTGIME039E
The entitlements: entitlement_1 and
entitlement_2 cannot be compared.
CTGIME041E
The attribute_name attribute value type
is not valid for the java_class_name Java
class.
Explanation: An attribute passed to the specified Java
class is not valid.
Administrator response: Check the syntax for the
attribute value.
CTGIME042E
An error occurred accessing the
configuration file. file_name
Explanation: An attempt to access a system property
needed for processing fail. The configuration file
containing the information could not be accessed.
Administrator response: Verify that the property and
property file exist in the appropriate location.
CTGIME043E
A type conversion error occurred
during compliance evaluation. Attribute:
attr_name
Explanation: The value doesn't correspond to the
attribute syntax type.
Administrator response: Check the value entered or
the provisioning parameter definition and compare
them to the attribute syntax type. Review the IBM
Security Privileged Identity Manager log files for
additional information about the error.
CTGIME201E
One or more arguments specified are
not valid for the method_name method.
Explanation: The arguments passed to the function
where not the ones expected. Either the argument type
specified or the number of arguments passed is
incorrect.
Administrator response: Verify that the arguments
being passed to the function meet the specifications of
the function.
CTGIME202E
The method_name implementation
class is not valid.
Explanation: An attempt to compare two entitlement
objects failed because the entitlements are for different
service targets.
Explanation: The script engine extension
implementation class does not contain one or more
requirements.
Administrator response: Verify that the two
entitlements are not for different service targets and try
the operation again. If the problem persists, check IBM
Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Administrator response: Check that the class name
and the implementation of the script engine extension
class is correct.
CTGIME203E
The following script interpreter error
occurred. Error: error_text
Explanation: The script program cannot be evaluated
because of an error.
Administrator response: Review the script file for
52
IBM Security Privileged Identity Manager: Error Message Guide
CTGIME204E • CTGIME214W
errors. Make the necessary changes and try the request
again.
CTGIME204E
An error occurred initializing the
object_type object. The following error
occurred. Error: error_text.
Explanation: The specified Java object could not be
instantiated. An attempt to instantiate the object
occurred while evaluating a script program that
references the object.
User response: System administrator should be
notified to analyze and correct this situation before
retrying the request.
CTGIME205E
IO error occurred when initializing
extension classes for the script engine
error_message method.
Explanation: This error may occur when the script
engine's implementation class cannot be initialized.
Administrator response: Verify that the class exists on
the Java classpath and that all required resources,
which the extension is using, are available to it.
CTGIME206E
The following error was detected in
the script. Error: error_text Error message:
error_msg
Explanation: The script program cannot be evaluated
because of an error triggered by the script author.
Administrator response: Review the script for coding
errors. Make the necessary changes and try the request
again.
CTGIME208E
An error occurred while loading Class
error_text.
Explanation: The scripting system tried to get the
Class object using Class.forName(String) and caught a
ClassNotFoundException.
Administrator response: Make sure the specified
Class file is on the java classpath.
CTGIME209E
Failed to create an instance of type
error_text.
Explanation: The scripting system tried to create a
new instance of the given type but was unable to. This
usually means that the type does not have the default
constructor necessary to use Class.newInstance().
Administrator response: Make sure the given type has
a public default (no argument) constructor.
CTGIME210W Failed to declare bean with name
error_text.
Explanation: An Exception occurred while declaring a
bean.
Administrator response: None.
CTGIME211E
The method error_text is not
supported in this version of the IBMJS
BSF Engine.
Explanation: The method you are trying to call is not
currently supported by JSBSFEngine.
Administrator response: None. This error should only
be seen by developers.
CTGIME212W In order to use the ext extension, the
HostComponent must implement the si
ScriptInterface.
Explanation: ITIM is trying to load a ScriptExtension
for a Host Component that does not support the
extension. The ScriptExtension will be unloaded and
script execution will continue.
Administrator response: In the
scriptframework.properties file, remove the offending
ScriptExtension from being loaded.
CTGIME213E
The wrapper factory cls could not be
instantiated dynamically. The error is:
err.
Explanation: The script framework tried to create an
instance of a wrapper factory using the Java reflection
mechanism and failed. This can be caused by the
wrapper factory not having a default, no-argument
constructor, the wrapper factory not being in the
current classpath, or the system not having permission
to instantiate a new instance of the wrapper factory
class.
Administrator response: The most common problem
is a misconfigured scriptframework.properties file.
Check to make sure that the offending factory has it's
full class name spelled correctly and that the class file
in the classpath.
CTGIME214W The WrapperFactory factory has been
passed an object of class cls to wrap.
This factory does not support that type
of object.
Explanation: The script framework tried to wrap an
object with a factory that does not know how to wrap
objects of that type. Since the script framework does
not know how to wrap this object it will not be
available to scripts.
Administrator response: Check
scriptframework.properties to make sure that only the
Messages
53
CTGIME215E • CTGIME403E
correct types of objects use specific wrapper factories.
For example, only classes that implement java.util.Map
should be handled by the JSMapWrapperFactory, and
only classes that implement java.util.Collection should
be handled by JSCollectionWrapperFactory.
CTGIME215E
The script framework has been asked
to use an interpreter that is not
supported. The unsupported interpreter
is interpreter.
Explanation: The script framework only supports a
limited number of script interpreters, each which has a
specific name and language string. The interpreter to
use for each host component must be one of: IBMJS
(language: javascript) or FESI (language: ecmascript).
Administrator response: Check
scriptframework.properties to make sure that all lines
that start with ITIM.interpreter.* have a value of either
ibmjs or fesi.
CTGIME219E
Explanation: The script framework tried to create an
instance of a script extension using the Java reflection
mechanism and failed. This can be caused by the
extension not having a default, no-argument
constructor, the extension not being in the current
classpath, or the system not having permission to
instantiate a new instance of the extension.
Administrator response: The most common problem
is a misconfigured scriptframework.properties file.
Check to make sure that the offending extension has it's
full class name spelled correctly, the class file is in the
classpath, and the extension has a default,
no-argument, consturctor.
CTGIME220E
CTGIME216W An exception has occurred while
reading the properties file file. Default
values will be used.
Explanation: The script framework encountered an
error while reading a properties file. Default values will
be used.
Administrator response: Check to make sure that the
specified file exists and that application server has read
permission to the file.
CTGIME217W An exception has occurred while
reading the property prop from the file
file. Default value will be used.
Explanation: The script framework encountered an
error while reading a property from given file. A
default value will be used.
Administrator response: Check to make sure that the
specified file exists and that application server has read
permission to the file. Also check that the specified
property exists in the properties file.
CTGIME218W An error occurred while initializing
the script extension extension for host
component host. The error message is:
message.
Explanation: The script framework encountered an
error while initializing a script extension. The extension
will not be loaded, but script execution will continue.
Administrator response: Check to make sure that the
host component with the error supports all of the
extensions loaded in scriptframework.properties.
The script framework tried and failed
to instantiate the script extension
extension. The error is: error
When deciding which script
interpreter to use for the host
component hc the script framework
found an unsupported interpreter:
interpreter. Using the default interpreter
instead.
Explanation: The script framework only supports a
limited number of script interpreters, and a host
component specified one that is not supported. The
default interpreter will be used instead. Please choose
one of: FESI or IBMJS.
Administrator response: The most common problem
is a misconfigured scriptframework.properties file.
Check to make sure that the offending host component
is configured to use one of FESI or IBMJS.
CTGIME401E
The fields must contain a value that
is greater than 0.
Explanation: The value specified is 0 or less. The field
requires a positive integer to be specified.
Administrator response: Verify that the Minimum
length and Maximum length fields value for the
password rule is an integer greater than 0.
CTGIME402E
One or more services must be
selected to define the password policy.
Explanation: A password policy requires at least one
service to be associated with it.
Administrator response: Select at least one service
under the Services tab on the Password Policy Add
page and click Continue.
CTGIME403E
A value for the Policy Name field is
missing. Type a value for this field.
Explanation: A policy name is required when defining
a password policy.
54
IBM Security Privileged Identity Manager: Error Message Guide
CTGIME405E • CTGIME613E
Administrator response: Specify a value for the Policy
Name field on the Password Policy Add page and click
Continue.
CTGIME405E
The value specified for two or more
password rules are in conflict.
Explanation: Two or more password rules are in
conflict. For example, the value for minimum length is
larger than the maximum length.
Administrator response: Check the values for the
password rules to ensure there are no conflicts.
CTGIME608E
Explanation: A separation of duty policy is invalid if
the exclusion rule refers to any roles that do not exist
in LDAP.
User response: Verify that the role listed above is
properly specified and was not deleted during the
creation of this policy.
CTGIME609E
CTGIME406E
The value specified for minimum
password length is greater than the
maximum allowed. Minimum value:
minimum_value Maximum value:
restriction
Explanation: The minimum password length value
specified in the password policy is too long.
Administrator response: Reduce the value for the
minimum password.
CTGIME601E
An identity policy with the same
specification already exists.
Explanation: Each identity policy must contain a
unique set of specifications.
Administrator response: Remove the duplicate
policies. Ensure that the set of specifications for each
policy is different.
CTGIME605E
The provisioning policy specified is
not found. It may have been deleted by
a concurrent user.
The separation of duty policy cannot
be saved because an exclusion rule
references a role which could not be
found in LDAP: role_dn.
The separation of duty policy cannot
be saved because the policy name is
missing or null.
Explanation: A policy name must be defined.
User response: Modify the policy name to have a
value that is not empty string or null.
CTGIME610E
The separation of duty policy cannot
be saved because a rule name is missing
or null.
Explanation: A rule name must be defined.
User response: Modify the name of the rule to have a
value that is not empty string or null.
CTGIME611E
The separation of duty policy cannot
be saved because an exclusion rule,
rule_name, does not reference any roles.
Explanation: An exclusion rule needs to reference
roles.
User response: Modify the exclusion rule to reference
a set of roles.
CTGIME606E
The password policy specified is not
found. It may have been deleted by a
concurrent user.
CTGIME612E
CTGIME607E
The separation of duty policy
operation operation_name could not be
invoked for policy policy_name.
Explanation: The allowed number of roles of an
exclusion rule should be greater than zero and less than
the number of roles for which the rule applies.
Explanation: An error prevented the policy operation
from starting.
User response: Read any additional messages for
further detail about the failure and corrective actions. If
no additional information exists and additional
attempts to complete the operation fail, contact your
system administrator.
Administrator response: Gather and look up any
additional message IDs that appear on the user
interface. Check the message log for detailed
information about the failure.
The separation of duty policy cannot
be saved because an exclusion rule,
rule_name, has an invalid allowed
number of roles.
User response: Modify the allowed number of roles to
fall within the valid range.
CTGIME613E
The separation of duty policy
contains one or more exclusion rule
names which are the same: rule_name
Explanation: Rule names must be unique within a
single separation of duty policy.
User response: Modify the name of the rule to
something different than the existing rule, or update
the existing rule with your changes.
Messages
55
CTGIME614E • CTGIME702W
CTGIME614E
The separation of duty policy cannot
be saved because the owner of the
policy could not be found in LDAP:
owner_dn.
Explanation: A separation of duty policy is invalid if
any of the owners of the policy do not exist in LDAP.
User response: Verify that the owner listed above is
properly specified and was not deleted during the
creation of this policy.
CTGIME615E
The separation of duty policy cannot
be saved because an exclusion rule
contains a role that is not within the
same root organization as itself.
Explanation: A policy exclusion rule can only contain
roles from within its root organization.
CTGIME618E
Explanation: Use the list of conflicting roles in the
message to determine which role to use in the
exclusion list. Because the role you are trying to add is
an ancestor of the role or roles listed in conflict, the
members of the descendant role in the exclusion list are
already included in the separation of duty policy
enforcement behavior. If you want to increase the scope
of the current exclusion list, remove the conflicting
child role or roles and try adding the new role to the
policy again.
User response:
CTGIME619E
User response: Remove all the roles within the policy
exclusion rules that are not in the same root
organization as the policy.
CTGIME616E
The separation of duty policy cannot
be saved because an owner of the
policy, owner_name, is in a different
organization than the organization of
the policy.
Explanation: A separation of duty policy owner must
be selected from the same organization as the
separation of duty policy.
User response: Verify that the owner listed above is
properly specified and is in the same organization as
the policy.
CTGIME617E
The role, failed_role_name, cannot be
added to the exclusion list because it is
a descendant of roles
conflicting_role_names.
Explanation: Two roles cannot exist in a separation of
duty policy exclusion list when they share a direct
ancestor or descendant in the role hierarchy. The role
being added to the exclusion list either conflicts with a
role currently in the list, or with another role you are
attempting to add.
User response: Use the list of conflicting roles in the
message to determine which role to use in the
exclusion list. Because the role you are trying to add is
a descendant of the role or roles listed in conflict, the
members of the role are already included in the
separation of duty policy enforcement behavior and
there is no need to take further action. If you would
like to reduce the scope of the separation of duty policy
exclusion list, then you may want to remove the
conflicting roles, and try adding the role again.
The role, failed_role_name, cannot be
added to the exclusion list because it is
a ancestor of roles conflicting_role_names.
The rule, rule name, cannot be saved
as part of the separation of duty policy
because it contains a role, role name,
which is is an ancestor of
conflicting_role_names.
Explanation: Use the list of conflicting roles in the
message to determine which role should be used in the
exclusion list. Because the role you are trying to add is
an ancestor of the role or roles listed in conflict, the
members of the descendant role in the exclusion list are
already included in the separation of duty policy
enforcement behavior. If you want to increase the scope
of the current exclusion list, remove the conflicting
child role or roles and try adding your new role to the
policy again.
User response:
CTGIME701W During user recertification policy
enforcement for user person_name, the
role with distinguished name
role_distinguished_name was ignored.
Either the user is no longer a member of
the role or the role no longer exists. The
processing and enforcement of other
resources will continue.
Explanation: The user was removed from the role
before the recertification remediation could be
processed. Since the user is no longer a member of the
role, the role was ignored.
Administrator response: No action is required.
CTGIME702W During user recertification policy
enforcement for user person_name, the
account with distinguished name
account_distinguished_name was ignored.
Either the account has been removed, or
the user no longer owns the account.
The processing and enforcement of
other resources will continue.
Explanation: Either the account was removed before
56
IBM Security Privileged Identity Manager: Error Message Guide
CTGIME703W • CTGIMF006E
the recertification was processed, or another user has
taken ownership of that account. Since the user no
longer owns this account, the account was ignored
during processing.
Administrator response: No action is required.
CTGIME704E
Administrator response: No action is required.
CTGIME703W During user recertification policy
enforcement for user person_name, the
group with distinguished name
group_distinguished_name on account
account_name was ignored. The account
is no longer a member of the group or
its corresponding access. The processing
and enforcement of other resources will
continue.
Explanation: The account was modified before the
recertification enforcement could be processed, and the
account is no longer in the specified group. Since the
account is not a member of the group it was ignored
during processing.
recertification_policy_name is not
applicable to user_name. Select other
recertification policy.
Explanation: The selected recertification policy is not
applicable for the user.
User response: Select other recertification policy and
run the policy.
CTGIME801E
More than one policy defined for a
target of the same specificity not
allowed.
Explanation: There cannot identical policies defined
for the same target.
Administrator response: Remove the duplicate
policies or change the policies so that each is unique.
Data services messages
CTGIMF001E
An error occurred while creating the
object.
Explanation: The data needed to create the object is
not valid causing a possible schema error or not
enough space on directory server.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the problem.
CTGIMF004E
Explanation: An error occurred retrieving the meta
data file.
Administrator response: Check that the file exists and
that the application has the proper authorization to
access the file.
CTGIMF005E
CTGIMF002E
A session with the directory server
cannot be established.
Explanation: A communication error occurred while
accessing the directory server. The directory server is
not available or overloaded with requests.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the problem. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMF003E
Data needed to process the object
cannot be found.
Explanation: An internal error occurred while
retrieving data needed to process an object.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the problem. If the problem persists,
check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The file_name meta data file cannot be
read.
The information in the file_name meta
data is not correct or outdated.
Explanation: The information in the meta data is not
correct or current.
Administrator response: Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman to validate the file and
obtain a new copy if necessary.
CTGIMF006E
The relationship file cannot be
instantiated. Check the CLASSPATH
statement and ensure the object is listed
in the statement.
Explanation: An error occurred instantiating the
relationship file.
Administrator response: Ensure that the relationship
file is listed in the CLASSPATH.
Messages
57
CTGIMF007E • CTGIMF015E
CTGIMF007E
The specified object cannot be found
in the directory server. The object might
have been moved or deleted before your
request completed. The following
information was returned from the
directory server: The object_name object
cannot be found. The following error
occurred. Error: error_text.
Explanation: An attempt to locate the object in the
directory server failed.
Administrator response: Ensure that the object still
exists and was not deleted by another user. You can
review the IBM Security Privileged Identity Manager
log files for additional information about the error. The
log files contain the DN name of the object, which you
can use to check the directory server to ensure that the
object exists.
Privileged Identity Manager log files for additional
information about the error.
CTGIMF012E
Explanation: The data in the directory server is
missing or corrupted.
Administrator response: Check the directory sever
object DN. Review the attributes for the relationship to
determine if it is missing or corrupted. If the data is
missing, make the necessary updates. Otherwise,
review the IBM Security Privileged Identity Manager
log files for additional information about the error.
Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMF013E
CTGIMF008E
The data received is not correct. An
expected parameter is missing.
Explanation: An internal processing error occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMF009E
The search results exceed the
maximum number of results. Increase
the search criteria and try again.
Explanation: The maximum search result limit has
been reached.
Administrator response: Add more search criteria to
reduce the number of items found.
CTGIMF010E
A problem occurred while performing
the search. The results may not be
complete.
CTGIMF011E
The container cannot be found.
Administrator response: From the user interface, look
up the profile name to verify it is in the directory
server. If missing, use the interface to define a profile
and try the operation again.
CTGIMF014E
The category_name category is not
valid.
Explanation: The specified category cannot be found.
A category is associated when defining an entity. This
association has been corrupted.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMF015E
The specified credential key_name
cannot be found in the credential vault.
The object might have been moved or
deleted before your request completed.
Explanation: An attempt to locate the object in the
credential vault failed.
Administrator response: Ensure that the credential
still exists and was not deleted by another user. You
can review the IBM Security Privileged Identity
Manager log files for additional information about the
error. The log files contain the key of the credential,
which you can use to check the credential vault to
ensure that the object exists.
Explanation: The system could not locate the
container.
Administrator response: Review the IBM Security
58
The profile_name profile cannot be
found.
Explanation: A profile is required for every object.
Explanation: The search did not complete before a
problem occurred. The problem may be temporary.
Administrator response: Try the search again. Review
the IBM Security Privileged Identity Manager log files
for additional information about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
The relation_name relationship not
found for the object_dn object.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMF016E • CTGIMF025E
CTGIMF016E
The object_name object already exists.
Explanation: The object already exists in the directory
server.
Administrator response: Change the name of the
object and try the operation again.
log to determine which attribute is not valid. Start the
IBM Security Privileged Identity Manager trace. Check
IBM Electronic Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMF022E
CTGIMF017E
The object_name object cannot be
modified. Another user is currently
using it. Details: explanation.
Explanation: Multiple users cannot modify an object
at the same time.
Administrator response: Wait until the object is
available and try the operation again.
CTGIMF018E
The data received is not what is
expected.
Explanation: The input data is not valid. The expected
data is missing or the data passed is not the correct
type.
Programmer response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check that the right
parameters are being passed and that the data type is
correct.
CTGIMF019E
An error occurred referencing the
object_name object. There is a duplicate
entry for the object.
Explanation: Cannot have two entries with the same
value in the system. The object could not be retrieved
because two objects with the same name exist.
Administrator response: Removed the duplicate entry.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMF020E
The dn_name DN is not valid.
Explanation: The value for distinguished name is not
valid.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMF021E
One or more attributes for the
object_name object are not valid. Error:
error_text
An error occurred while removing the
object_name object. Error: error_text
Explanation: The object could not be removed from
the directory server. An internal processing error
occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMF023E
The directory server is not available.
Start the directory server.
Explanation: A communication error occurred while
accessing the directory server. The directory server is
not available or overloaded with requests.
Administrator response: Verify that the directory
server is available and that there are no network
outages, and try the operation again. Review the IBM
Security Privileged Identity Manager log files for
additional information about the problem. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMF024E
The user ID is null. Check that the
Identity Policy exists.
Explanation: The user ID is null.
Administrator response: Check that the Identity
Policy exists. Review the IBM Security Privileged
Identity Manager log files for additional information.
CTGIMF025E
Invalid target type: target_size. Target
for account templates is not a service
instance.
Explanation: For account templates defined at
organizational level, the service target type must be a
service instance.
Administrator response: Verify that the service target
is a service instance. Review the IBM Security
Privileged Identity Manager log files for additional
information.
Explanation: A directory schema violation occurred.
The object is not part of the schema.
Administrator response: Review the directory server
Messages
59
CTGIMF026E • CTGIMG001E
CTGIMF026E
Invalid target type: target_size. Target
for a global account template is not a
service profile.
Explanation: For global account templates, the service
target type must be a service profile.
Administrator response: Verify that the service target
is a service profile. Review the IBM Security Privileged
Identity Manager log files for additional information.
CTGIMF027E
Invalid number of targets: target_size.
More than one target was specified for
an account template.
Explanation: One and only one service target is
supported for an account template.
Administrator response: Verify that the number of
service targets is one. Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMF029E
The specified object cannot be found
in the directory server. The object might
have been moved or deleted before your
request completed. The following
information was returned from the
directory server: The object_name object
cannot be found with the specified
name tenant_id.
Explanation: An attempt to locate the object in the
directory server failed.
Administrator response: Ensure that the object still
exists and was not deleted by another user. You can
review the IBM Security Privileged Identity Manager
log files for additional information about the error. The
log files contain the DN name of the object, which you
can use to check the directory server to ensure that the
object exists.
CTGIMF030E
Multiple objects found for uri URI in
container_dn organizational container.
Explanation: There are multiple objects of the same
type found for the specified URI and organizational
container.
Programmer response: Ensure that the specified URI
is correct and specify a different organizational
container for the search context.
CTGIMF031E
The role assignment attribute
assignment_attribute_name cannot be
removed from role_name.
Explanation: When one or more persons have the
value for the specified role assignment attribute, the
assignment attribute cannot be removed from the role.
Programmer response: Ensure that the specified
assignment attribute is not removed when setting the
assignment attributes to a role.
CTGIMF032E
The model extension class class_name
could not be loaded.
Explanation: The model extension class name might
be incorrect or not located in the class path of the
application.
Administrator response: Ensure that the class name is
correct and located in the classpath of the application.
CTGIMF033E
The rule definition of the model
extension plugin for attribute
attribute_name could not be found.
Explanation: Every attribute listed in the attribute
extension property file must have a corresponding rule
definition.
Administrator response: Check the attribute extension
property file to ensure that a rule is defined for each
attribute.
CTGIMF034E
An error occured while running the
model extension plugin for the attribute
attribute_name.
Explanation: The model extension plugin threw an
unexpected exception during execution.
Administrator response: Check the exception in the
WebSphere SystemOut log file to determine the cause
of the error.
Service management messages
CTGIMG001E An error occurred while saving the
rule_name adoption rule.
Explanation: An error occurred while saving an
adoption rule into the directory server. Possible reasons
are directory server schema or data violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
60
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
save the adoption rule into the directory server failed.
A message is written to log file.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMG002E • CTGIMG008E
CTGIMG002E An error occurred while updating the
rule_name adoption rule.
CTGIMG005E The services referenced by
provisioning policies cannot be deleted.
Explanation: An error occurred while updating an
adoption rule into the directory server. Possible reasons
are directory server schema or data violations.
Explanation: A service cannot be deleted if there is a
policy being enforced on service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
save the adoption rule into the directory server failed.
A message is written to log file.
CTGIMG003E An error occurred while removing
the adoption rule.
Explanation: An error occurred while removing an
adoption rule from the directory server. Possible
reasons are directory server schema or data violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
delete the adoption rule from the directory server
failed. A message is written to log file.
CTGIMG004E An error occurred while retrieving
information of the adoption rule.
Explanation: An error occurred while retrieving an
adoption rule from the directory server. Possible
reasons are directory server connection failure or data
integrity violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
delete the adoption rule from the directory server
failed. A message is written to log file.
Administrator response: Remove the policies, which
have the targeted services as entitlements.
CTGIMG006E An error occurred while saving the
compliance alert configuration.
Explanation: An error occurred while saving the
compliance alert configuration to the directory server.
Possible reasons are directory server schema or data
violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
create the compliance alert configuration in the system
failed. A message is written to log file.
CTGIMG007E An error occurred while updating the
compliance alert configuration.
Explanation: An error occurred while saving the
compliance alert configuration to the directory server.
Possible reasons are directory server schema or data
violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
update the compliance alert configuration in the system
failed. A message is written to log file.
CTGIMG008E An error occurred while removing
the compliance alert configuration.
Explanation: An error occurred while removing the
compliance alert configuration from the directory
server. Possible reasons are directory server schema or
data violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
Messages
61
CTGIMG009E • CTGIMG016E
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
remove the compliance alert configuration from the
system failed. A message is written to log file.
CTGIMG009E An error occurred while adding the
service_name service.
Explanation: The system was unable to successfully
create a service based on the provided input.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG010E An error occurred while deleting a
service.
Explanation: The system was unable to successfully
remove the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG011E An error occurred while updating the
service_name service.
Explanation: The system was unable to successfully
update the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG012E An error occurred while retrieving
detailed information of the service.
Explanation: The system was unable to successfully
retrieve detailed information of the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
62
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG013E An error occurred while testing the
connection for the service_name service.
Explanation: The system was unable to successfully
test the connection of the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG014E An error occurred while retrieving
prerequisite information of a service.
Explanation: The system was unable to successfully
retrieve prerequisite information of the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG015E An error occurred while retrieving
password property of a service.
Explanation: The system was unable to successfully
retrieve password information of the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG016E An error occurred while retrieving
one or more accounts for the service.
Explanation: The system was unable to successfully
retrieve accounts of the service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMG017E • CTGIMG024E
CTGIMG017E An error occurred while executing
policy enforcement for service
[rule_name].
Explanation: The system was unable to successfully
complete execution of the policy enforcement of the
service.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG018E An error occurred while executing
global policy enforcement.
Explanation: The system was unable to successfully
run global policy enforcement.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG019E An error occurred while retrieving
the profile of the service. The service
might have been deleted. The DN of the
service is service_name.
Explanation: The system was unable to successfully
retrieve the profile of the service.
Administrator response: Ensure that the service still
exists. If the service still exists, try the operation again.
If you cannot determine the cause of the error, review
the IBM Security Privileged Identity Manager and
directory server log files for additional details about the
error. If the problem persists, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG020E An error occurred while retrieving
information for an adoption rule.
CTGIMG021E An error occurred while retrieving
the compliance alert configuration.
Explanation: An error occurred while retrieving the
compliance alert configuration from the directory
server. Possible reasons are directory server schema or
data violations.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. Verify that
the directory server is available and there are no
network outages and try the operation again. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
An attempt by the service management component to
remove the compliance alert configuration from the
system failed. A message is written to log file.
CTGIMG022E An error occurred while adopting one
or more orphan accounts.
Explanation: The system was unable to successfully
adopt one or more orphan accounts.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG023E An error occurred while
de-provisioning one or more orphan
accounts.
Explanation: The system was unable to successfully
de-provisioning one or more orphan accounts.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
Explanation: The system was unable to successfully
retrieve information for an adoption rule.
CTGIMG024E An error occurred while viewing the
details for an orphan account.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
Explanation: The system was unable to successfully
retrieve information of an orphan account.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
Messages
63
CTGIMG025E • CTGIMG036E
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG025E
The entitlement cannot found.
Explanation: The system was unable to successfully
find an entitlement.
Administrator response: Check that an entitlement is
defined for the service. Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG031E
The search parameter is missing.
Explanation: A search argument must be specified to
search for orphan accounts.
Administrator response: Specify a search argument
and try the operation again.
CTGIMG032E There was a problem executing the
specified action on the manual service
for action_name. The internal request ID
is request_id.
Explanation: An internal error occurred while
executing the process for the given manual service. The
action will be marked as failed and will need to be
retried at a later date if desired.
CTGIMG026E One or more policy conflicts
occurred. Click appropriate action to
continue; else click Cancel.
Administrator response: Check the log files and retry
the action as necessary.
Explanation: Some policy conflicts occurred.
CTGIMG033E There was a problem updating the
manual service. Changes were not
saved.
User response: Resolve the policy conflicts and
continue.
CTGIMG027E A service prerequisite conflict
occurred.
Explanation: The current service cannot be set as a
prerequisite.
User response: Assign a different service as the
prerequisite.
CTGIMG028E Circular dependency for the service
encountered.
Explanation: The selected service cannot be set as a
prerequisite because of circular dependency.
User response: Assign a different service prerequisite.
CTGIMG029E One or more parameters cannot be
retrieved.
Explanation: The page parameters cannot be retrieved.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional details about the error. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMG030E The expression is missing. Select an
expression.
Explanation: An expression is required.
Administrator response: Select an expression to
continue.
64
Explanation: There was a problem updating the
manual service. Changes were not saved.
Administrator response: Double check the content of
the form and retry. Check the log files and retry the
action as necessary.
CTGIMG034E Invalid prerequisite. Service
[service_name] cannot be used as
prerequisite.
Explanation: The prerequisite service cannot be either
DSML HR Feed or IDI Data Feed. Please select different
service for prerequisite.
CTGIMG035E The specified service is not found. It
might have been deleted by a
concurrent user.
Explanation: The system was unable to find the
service for this enforcement. It might have been deleted
by another user.
Administrator response: Make sure the service still
exists and not removed by other user.
CTGIMG036E The specified service is not a manual
service or a connected manual service.
The reconciliation cannot proceed.
Explanation: The service does not support performing
a manual reconciliation.
Administrator response: Modify the service
connection mode by setting it to manual if connection
mode is supported by the service type.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMG037E • CTGIMG049E
CTGIMG037E Connection mode is not supported
for the service type. service_type.
Explanation: Connection mode is not supported on
ITIM service or any type of identity feed service,
hosted service, or manual service types.
Administrator response: If connection mode is
supported by the service type, use form designer to
add the erconnectionmode attribute to the customized
form.
CTGIMG038E The service type or the service
instance does not support specifying
manual activities.
Explanation:
Administrator response:
CTGIMG039E The system cannot remove the
service_name service. This service is
specified as the WebSphere account
repository.
Explanation: The WebSphere account repository
cannot be removed. You must remove the reference that
specifies this service as the WebSphere account
repository before you can remove this service.
User response: To remove the reference that specifies
this service as the WebSphere account repository, go to
ITIM Service and clear the WebSphere account
repository attribute. Then try to remove the service
again.
CTGIMG040E The tenant named tenant_name could
not be found in the directory.
Explanation: While dealing with the recertification
configuration, the system could not find the tenant
supplied.
CTGIMG041E The service named service_name could
not be found in the directory.
Explanation: While dealing with the recertification
configuration, the system could not find the service
supplied.
CTGIMG042E Unable to add/update the lifecycle
rule for the global recertification
configuration.
Explanation: There was a problem while
adding/updating the lifecycle rule for the global
recertification configuration. See the trace log for more
information.
CTGIMG043E Unable to add/update the lifecycle
rule of the recertification configuration
for service service_name.
Explanation: There was a problem while
adding/updating the lifecycle rule of the recertification
configuration for the given service. See the trace log for
more information.
CTGIMG044E Unable to remove the lifecycle rule
for the global recertification
configuration.
Explanation: There was a problem while removing the
lifecycle rule for the global recertification configuration.
See the trace log for more information.
CTGIMG045E Unable to remove the lifecycle rule
for the recertification configuration for
service service_name.
Explanation: There was a problem while removing the
lifecycle rule for the recertification configuration for the
given service. See the trace log for more information.
CTGIMG046E Unable to remove the operational
workflow for the global recertification
configuration.
Explanation: There was a problem while removing the
operational workflow for the global recertification
configuration. See the trace log for more information.
CTGIMG047E Unable to remove the operational
workflow for the recertification
configuration for service service_name.
Explanation: There was a problem while removing the
operational workflow for the recertification
configuration for the given service. See the trace log for
more information.
CTGIMG048E Unable to add/change the operational
workflow for the global recertification
configuration.
Explanation: There was a problem while
adding/changing the operational workflow for the
global recertification configuration. See the trace log for
more information.
CTGIMG049E Unable to add/change the operational
workflow for the recertification
configuration for service service_name.
Explanation: There was a problem while
adding/changing the operational workflow for the
recertification configuration for the given service. See
the trace log for more information.
Messages
65
CTGIMG050E • CTGIMG064E
CTGIMG050E Unable to find lifecycle rule id for
the global recertification configuration.
Explanation: There was a problem finding the lifecycle
rule id for the global recertification configuration. See
the trace log for more information.
CTGIMG051E Unable to find lifecycle rule id for
the recertification configuration for
service service_name.
Explanation: There was a problem finding the lifecycle
rule id for the recertification configuration for the given
service. See the trace log for more information.
CTGIMG052E Unable to find the global
recertification configuration.
Explanation: There was a problem finding the global
recertification configuration. See the trace log for more
information.
CTGIMG053E Unable to find the recertification
configuration for service service_name.
Explanation: There was a problem finding the
recertification configuration for the given service. See
the trace log for more information.
CTGIMG054E Unable to determine the
recertification period from the
recertification configuration.
Explanation: There was a problem determining the
recertification period from the lifecycle rule filter for
the recertification configuration. See the trace log for
more information.
CTGIMG055E Unable to add recertification policy
named policy_name.
Explanation: There was a problem while adding
recertification policy configuration for the given service.
See the trace log for more information.
CTGIMG056E Unable to retrieve for the
recertification policy named policy_name.
Explanation: There was a problem while searching for
recertification policies for the given name. See the trace
log for more information.
CTGIMG057E Unable to retrieve for the
configuration information for
recertification policy named policy_name.
CTGIMG058E A non service instance was
encountered while operating on a
recertification policy.
Explanation: Recertification policies only support
service instances.
CTGIMG059E Unable to retrieve the recertification
policy for the service_name service.
Explanation: There was a problem while retrieving the
configuration portion of the recertification for a service.
See the trace log for more information.
CTGIMG060E Unable to remove recertification
policy named policy_name.
Explanation: There was a problem while removing
recertification policy configuration for the given service.
See the trace log for more information.
CTGIMG061E You are not allowed to remove the
global recertification policy.
Explanation: You can not remove the global policy
once it is defined in the system.
CTGIMG062E The service or access target
service_or_access_target_name of your
policy is already is use by another
recertification policy named policy_name.
Explanation: The recertification policy cannot target a
service or access that is already defined as a target of
another recertification policy.
Administrator response: Choose another service or
access target for this policy. If you want to change the
policy which affects the listed target, modify the policy
named in the message instead.
CTGIMG063E Unable to run the recertification
policy named policy_name.
Explanation: There was a problem attempting to run
the specified recertification policy. See the trace log for
more information.
CTGIMG064E Provisioning policies are not found
for service_name.
Explanation: Cannot find policies to enforce the
service.
User response: Define a valid provisioning policy for
the service and try again.
Explanation: There was a problem while retrieving the
configuration portion of the recertification policy for
the given name. See the trace log for more information.
66
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMG065E • CTGIMH007E
CTGIMG065E Service restart is not supported for
the service service_name.
Explanation: Service restart is only supported for
services that make provisioning requests to remote
adapter systems. An attempt to restart the ITIM
Service, a hosted ITIM Service, a feed, or a manual
service will fail, since it cannot be completed properly.
Administrator response: Select a different service for
restart.
CTGIMG066W The last test attempt on the service
failed. See additional messages for
failure details.
Explanation: A previous attempt to test the service
failed. Additional information about the failure should
be displayed along with this message. The test failure
needs to be corrected to ensure proper operation of the
service.
User response: Examine the detail message, correct
the service or adapter configuration, and repeat the
service test.
CTGIMG100W The component that monitors thread
hangs could not be initialized due to an
unexpected error.
Explanation: The application could not initialize
detailed thread hang monitoring. Normal processing
can continue, but notifications of thread hang events
will not be provided.
User response: Check the logs for additional
information regarding the error.
CTGIMG101W A suspected hang was detected on
thread thread_name while making a
request to the service service_name
(service_dn). A request to perform
operation type operation_type has not
completed after runtime_secs seconds.
Explanation: The application server detected a thread
hang during execution of a request to an adapter,
during execution of a workflow activity.
User response: Verify the service configuration
information for the referenced service. Test the service
for connectivity issues.
CTGIMG102W A suspected hang was detected on
thread thread_name while executing root
process root_process_id, process process_id,
and activity activity_id. Execution of
activity activity_design_id within
workflow process type process_type_code
has not completed after runtime_secs
seconds.
Explanation: The application server detected a thread
hang during execution of a workflow activity.
User response: If the workflow definition or activity
have been customized, check the customizations for
any programming errors.
CTGIMG103W A suspected hang was detected on
thread thread_name while making a
request to the service service_name
(service_dn). The request to perform
operation type operation_type occurred
while executing root process
root_process_id, process process_id, and
activity activity_id. The request has not
completed after runtime_secs seconds.
Explanation: The application server detected a thread
hang during execution of a request to an adapter,
during execution of a workflow activity.
User response: Verify the service configuration
information for the referenced service. Test the service
for connectivity issues.
Password management messages
CTGIMH001E The password does not meet the
requirements of the password rules.
Explanation: The specified password must meet all
requirements of the password rules.
User response: Examine the password rules and create
a new password that meets all requirements of the
password rules.
CTGIMH005E A password cannot be generated. The
maximum number of times for
generating a password has been
exceeded.
Explanation: The combination of password rules is too
restrictive preventing the system from generating a
random password within the maximum number of
attempts.
User response: Review the password rules to ensure
they are not too restricted when combined. Report the
message to the administrator.
Administrator response: Modify the password rules
to allow for successful password generation.
CTGIMH007E One or more letters are in lowercase
where uppercase letters are expected.
Explanation: The specified password does not
conform to the password rule regarding letter case. One
or more letters in the password is expected to be in
Messages
67
CTGIMH008E • CTGIMH016E
uppercase. On the Manage Password page click the
icon under the Rule column for the appropriate service
to view the password rules associated with the service.
CTGIMH012E The specified restrictions on
password length are not compatible.
User response: Retype your password using the
appropriate case.
Explanation: The password rule cannot be combined
because the length restriction is not compatible with the
one or more password rules for the selected accounts.
CTGIMH008E One or more letters are in upper case
character where lower cases are
expected.
User response: Make sure to change password by
selecting individual account or contact system
administrator to make sure that the password rules are
compatible for all the accounts.
Explanation: The specified password does not
conform to the password rule regarding letter case. One
or more letters in the password is expected to be in
lowercase. On the Manage Password page click the icon
under the Rule column for the appropriate service to
view the password rules associated with the service.
User response: Retype your password using the
appropriate case. Verify that the Caps lock key is
turned off.
CTGIMH009E The specified restrictions relating to
case format are not compatible.
Explanation: Unable to combine password rules
because the case restriction for the characters is not
compatible with the one or more password rules for the
selected accounts.
User response: Make sure to change password by
selecting individual account or contact system
administrator to make sure that the password rules are
compatible for all the accounts.
CTGIMH010E The password exceeds the maximum
number of characters.
Explanation: The number of character in the specified
password exceeds the password rule defining the
maximum number of characters. From the Manage
Password page, click the icon under the Rule column
for the appropriate service to view the password rules
associated with the service.
User response: Reduce the number of characters in
the password to the number allowed as defined in the
password rule and submit the password again.
CTGIMH011E The password does not adhere to the
minimum number of characters.
Explanation: The number of character in the specified
password does not meet the minimum number of
character as specified in the password rule. On the
Manage Password page, click the icon under the Rule
column for the appropriate service to view the
password rules associated with the service.
User response: Increase the number of characters in
the password to meet the minimum number of
character password rule and submit the password
again.
68
CTGIMH013E There are too many repeated
characters in the password.
Explanation: The password contains a repeated
character that exceeds the maximum times the
character can be repeated as specified by the password
rule. On the Manage Password page, click the icon
under the Rule column for the appropriate service to
view the password rules associated with the service.
User response: Increase the number of characters in
the password to meet the minimum number of
character password rule and submit the password
again.
CTGIMH014E The password contains a character
that is not valid.
Explanation: A character has been entered for the
password that has been configured by the
administrator as a restricted character. The password
must not contain a restricted character.
User response: Remove the restricted characters from
the password and submit the password again.
CTGIMH015E Incompatible may not contain
character restrictions
Explanation: Unable to combine password rules as
character restriction is not compatible with the one or
more password rules for the selected accounts.
User response: Make sure to change password by
selecting individual account or contact system
administrator to make sure that the password rules are
compatible for all the accounts.
CTGIMH016E The password does not contain any
of the required characters.
Explanation: The password rule requires that the
password contain at least one of a set of required
characters. To view the password rules, from the
Manage Password page, click the icon under the Rule
column for the appropriate service.
User response: Type a password that meets the
required character password rule and submit the
password again.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMH017E • CTGIMH028E
CTGIMH017E Incompatible must contain character
restrictions
under the Rule column for the appropriate service.
User response: Type a password that meets the no
user name password rule and submit the password
again.
Explanation: The password rules cannot be combined
because the character restriction is not compatible with
the one or more password rules for the selected
accounts.
CTGIMH024E
User response: Make sure to change password by
selecting individual account or contact system
administrator to make sure that the password rules are
compatible for all the accounts.
Explanation: Unable to combine password rules as the
starts with character restriction is not compatible with
the one or more password rules for the selected
accounts.
CTGIMH020E The new password cannot be the
same as any previously used passwords.
User response: Make sure to change password by
selecting individual account or contact system
administrator to make sure that the password rules are
compatible for all the accounts.
Explanation: The new password is the same as a
previous used password. The password rule requires
that new password cannot be the same as a previously
used password. To view the password rules from the
Manage Password page, click the icon under the Rule
column for the appropriate service.
User response: Type a password that meets the
repeated password rule and submit the password
again.
CTGIMH021E The new password cannot be the
reverse of any previously used
passwords.
Explanation: The new password is the reverse of a
previously used password. The password rule requires
that a combination of new characters be used for the
new password. To view the password rules from the
Manage Password page, click the icon under the Rule
column for the appropriate service.
User response: Type a password that meets reverse
repeated password rule and submit the password
again.
CTGIMH022E An user ID cannot be part of a
password.
Explanation: The characters of the new password
contain the user ID for which the password is being
created. The password rule does not allow the user ID
to be part of the password. To view the password rules
from the Manage Password page, click the icon under
the Rule column for the appropriate service.
User response: Type a password that meets the no
user ID password rule and submit the password again.
CTGIMH023E A user name cannot be part of a
password.
Explanation: The characters of the new password
contain the user name for which the password is being
created. The password rule does not allow the user
name to be part of the password. To view the password
rules from the Manage Password page, click the icon
Incompatible starts with restrictions
CTGIMH025E The password does not start with one
of the required characters.
Explanation: The password rules require that the
password begin with one of a require set of characters.
To view the password rules, from the Manage
Password page, click the icon under the Rule column
for the appropriate service.
User response: Type a password that meets the starts
with required character password rule and submit the
password again.
CTGIMH027E The password must contain restricted
to characters only.
Explanation: The password must contain only
characters that have been identified in the password
rules. To view the password rules, from the Manage
Password page, click the icon under the Rule column
for the appropriate service.
User response: Type a password that meets the starts
with required character password rule and submit the
password again.
CTGIMH028E The password contains a word that
has been identified as restricted.
Explanation: The password rule has been configured
to search for words in a password dictionary. The
specified password contains one of the words listed in
the password dictionary. The password dictionary
contains a list of words that cannot be used. To view
the password rules, from the Manage Password page,
click the icon under the Rule column for the
appropriate service.
User response: Type a password that does not contain
any words in the password dictionary and submit the
password again.
Messages
69
CTGIMH029E • CTGIMH047W
CTGIMH029E The password does not contain the
required minimum number of
alphabetic characters.
Explanation: The number of alphabetic characters in
the specified password does not meet the minimum
number specified in the password rules. To view the
password rules, from the Manage Password page, click
the icon under the Rule column for the appropriate
service.
User response: Increase the number of alphabetic
characters in the password to meet the minimum
number required by the password rules. Submit the
password again.
CTGIMH030E The password does not contain the
required minimum digit characters
Explanation: The number of numeric characters in the
specified password does not meet the minimum
number specified in the password rules. To view the
password rules, from the Manage Password page, click
the icon under the Rule column for the appropriate
service.
User response: Increase the number of numeric
characters in the password to meet the minimum
number required by the password rules. Submit the
password again.
CTGIMH031E The password does not contain the
required minimum number of unique
characters.
Explanation: The number of unique characters in the
specified password does not meet the minimum
number of unique characters specified in the password
rules. To view the password rules, from the Manage
Password page, click the icon under the Rule column
for the appropriate service.
User response: Change the password to contain at
least a minimum number of unique characters and
submit the password again.
User response: Select at least one account and submit
password change.
CTGIMH035E The value for the New Password
field is missing.
Explanation: The value for the New Password field is
required to change a password.
User response: Specify a value and click Submit.
CTGIMH036E The value for the Confirm Password
field is missing. Type the same value
entered for the New Password field.
Explanation: The value for the Confirm Password
field is required to change a password.
User response: Specify the same value entered for the
New Password field and click Submit.
CTGIMH037E The values for the New Password
and Confirm Password fields do not
match. Enter the desired password in
both fields.
Explanation: The New Password and Confirm
Password fields must have the same value.
User response: Specify the same value for both New
Password and Confirm Password fields and click
Submit.
CTGIMH044E A password must be specified to
continue. Enter a valid password.
Explanation: A password is required to continue.
User response: Specify the appropriate password.
CTGIMH045E The value for the Old Password field
is missing.
Explanation: The value for the Old Password field is
required to change a password.
User response: Specify a value and click Submit.
CTGIMH033W Select more than one account to
view the combined password rules.
Explanation: To view combined Password rules,
multiple accounts must be selected from the Service
table on the Manage Password page.
User response: Select the desired accounts and click
View Combined Password Rules to view all the rules
associated with the accounts selected.
CTGIMH034E At least one account must be selected
to change password.
Explanation: To change password, at least one account
must be selected from the Service table on the Manage
Password page.
70
CTGIMH047W Your password is no longer valid.
Either the password has expired or you
are being forced to change the
password. Create a new password to
continue.
Explanation: The specified password is no longer
valid. It has either expired since the last password
change or your system administrator is requiring that
the password for your account be changed.
User response: Create a new password according to
the password rules from the Change/Create Password
page. After you have successfully created a new
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMH048E • CTGIMH059W
password, use the new password to log into your
account.
CTGIMH048E The change password request for
your Identity Manager account has
timed out. Try your request again later.
Explanation: The change password request has been
pending for more than a minute and has been canceled.
User response: Try again after some time. If the
problem persists, contact the system administrator to
complete the change password request.
CTGIMH049E The change password request has
been submitted successfully but has not
completed. Wait for ten minutes and
then login with the new password.
Explanation: The change password request is still
processing.
User response: After ten minutes, login with the new
password. Contact the administrator, if you unable to
login with new password. There may be network
problems preventing the request from completing.
CTGIMH050W The account is being modified or
has been removed from the system.
Explanation: The user ID of the account might have
been modified or the account has been removed from
the system.
User response: Refresh the account and try the
operation again.
CTGIMH051E The value entered for Old Password
field is not correct. Enter the correct
password.
Explanation: The value for the Old Password field is
not correct. Verify that you are typing in the correct
value. Ensure that the capitalization is correct.
User response: Type in the password and submit the
password again.
CTGIMH052E The value entered for the Old
Password field is not correct. There are
pw_attempts_left attempts left for entering
a correct password.
Explanation: The value for the Old Password field is
not correct. The invalid password attempts system
property defines the number of times an incorrect
password can be specified. Once the number of tries
exceeds this value the account will be suspended.
CTGIMH053E The password cannot be reset for the
accounts.
Explanation: Access to one or more accounts is not
available to reset the password.
User response: Contact the system administrator to
reset the password for the accounts.
CTGIMH054E
There is no account for person_name.
Explanation: An account for the specified person
cannot be found.
User response: Contact the system administrator to
make sure that you have at least one valid account.
CTGIMH055E There are no existing accounts for
this person. The accounts may be
inactive, or access is denied, or the
account does not require a password.
Explanation: A valid account cannot be found for the
person. Or, a change password request is being
requested for an account that has no password.
User response: Make sure that the person has at least
one valid account to change password.
CTGIMH057E
The shared secret is not correct.
Explanation: To retrieve a new password from a
location contained in the email the shared secret must
be specified.
User response: Ensure that the correct shared secret is
entered.
CTGIMH058E
The transaction ID cannot be found.
Explanation: The request to retrieve a password has
expired and cannot be retrieved.
User response: Contact the system administrator to
create password for you again.
CTGIMH059W The system configuration has
disabled email delivery of passwords.
Choosing Continue will reset the
password to a random value but not
send any email notification of the new
password value.
Explanation: The system has been configured not to
send passwords by email.
User response: Contact the system administrator.
User response: Type in a valid password and submit
the password again.
Messages
71
CTGIMH060W • CTGIMI009E
CTGIMH060W Since you do not have an email on
file for this account, a new password
cannot be sent to you. Contact the
system administrator to obtain a new
password.
Explanation: There is no email address associated
with your account to send a new password.
User response: Contact the system administrator.
Account management messages
CTGIMI001E
The synchronization of passwords
cannot complete because person_name
does not have the synchronized
password.
Explanation: Password synchronization requires that
the specified person must have the password before
starting the validation process. This message is
displayed when the synchronized password is missing
for the person.
Programmer response: Ensure the person has the
synchronized password and start the validation process
again.
The account management component detected that the
required information for password validation is not
available. A message is written to the log file.
CTGIMI002E
The current synchronized password
for restoring the account_name account
does not conform to the password rules
for the account.
Explanation: When password synchronization is
enabled; the synchronized password is used for
restoring accounts. The password must conform to the
password rules of the accounts being restored.
Programmer response: Specify the password on the
restore() method.
CTGIMI003E
The account_name account cannot be
orphaned.
Explanation: The account owner for the IBM Security
Privileged Identity Manager account cannot be
removed.
Programmer response: Verify that the account is not
an account managed by IBM Security Privileged
Identity Manager.
CTGIMI004E
The accounts cannot be found. These
accounts might have been deleted
already.
Explanation: The accounts cannot be found in the
directory server. The accounts might have been deleted
before your request completed.
User response: Verify that the accounts exist. If you
are assigning accounts to another person, the accounts
may have been concurrently deleted or assigned by
another user of the system.
72
CTGIMI005E
A non-compliant account cannot be
provisioned if the enforcement action is
Suspend or Correct or Account Change
Alert is disabled.
Explanation: A non-compliant account cannot be
provisioned if the enforcement action is Suspend or
Correct or Account Change Alert is disabled.
User response: Provision an account that conforms to
the provisioning policy.
CTGIMI006E
The account cannot be modified to
non-compliant if the enforcement action
is Suspend or Correct or Account
Change Alert is disabled.
Explanation: The account cannot be modified to
non-compliant if the enforcement action is Suspend or
Correct or Account Change Alert is disabled.
User response: Modify the account to compliant
account with provisioning policy.
CTGIMI007E
The non-compliant accounts cannot be
restored if the enforcement action is
Suspend or Correct.
Explanation: The non-compliant accounts cannot be
restored if the enforcement action is Suspend or
Correct.
User response: Make the account compliant with
provisioning policy before restoring the account.
CTGIMI008E
Disallowed account cannot be adopted
if the enforcement action is Correct. The
account name is account_name.
Explanation: Disallowed account cannot be adopted if
the enforcement action is Correct.
User response: Make sure the account is not
disallowed by the provisioning policy if the
enforcement action is Correct.
CTGIMI009E
The default system administrator
account cannot be deleted.
Explanation: A request to delete the system
administrator account failed. The default system
administrator is the mandatory IBM Security Identity
Manager administrator account. This account cannot be
deleted.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMI010E • CTGIMI023E
User response: Do not delete this account.
CTGIMI019E
Programmer response: Verify that the application
program interface is not deleting the default system
administrator account.
CTGIMI010E
The default system administrator
account cannot be suspended.
Explanation: A request to suspend the system
administrator account failed. The default system
administrator is the mandatory IBM Security Identity
Manager administrator account. This account cannot be
suspended.
User response: Do not suspend this account.
Programmer response: Verify that the application
program interface is not suspending the default system
administrator account.
CTGIMI011E
The user ID and associated group of
default system administrator cannot be
changed or deleted.
Explanation: The default system administrator is the
mandatory administrator account for the IBM Security
Privileged Identity Manager system.
User response: Do not modify the administrator
group or its user ID of default system administrator.
Programmer response: Verify that the application
program interface is not deleting the administrator
account or modifying the default user ID.
CTGIMI013E
A request to restore one or more
accounts did not complete because the
accounts do not have an owner.
Explanation: An account must have an owner to be
restored.
User response: Assign an owner to the account and
try the operation again.
CTGIMI018E
The account_name account cannot be
verified for compliance with the policy.
Explanation: One or more of the selected accounts to
restore did not pass the policy compliance check. The
IBM Security Identity Manager server or the directory
server may not be available to obtain the necessary
data to perform the check.
Administrator response: Ensure that the IBM Security
Privileged Identity Manager server and the directory
server are running. Review the IBM Security Identity
Manager log files for additional information regarding
the error looking for messages associated with the
account name. Review the provisioning policy script for
errors.
The following accounts cannot be
deleted since these accounts are
governed by automatic provisioning
policy: account_name- Service_nameOwner_name
Explanation: One or more of the selected accounts
cannot be deleted. The user should have at least one
account in a service that is governed by the automatic
provisioning policy and this account cannot be deleted.
Administrator response: Remove the account from the
list of accounts to be deleted.
CTGIMI020W One or more of the selected accounts
cannot be changed. The access control
information does not allow these
functions to be performed for the
accounts.
Explanation: A request to suspend, restore, or remove
an account is not performed because the user making
the request does not have authorization to perform
those functions for the account selected. The request is
completed for accounts that the user has authorization
to access.
Administrator response: Change the access control
information, if the user should have authorization to
change the account.
CTGIMI021E
Required accounts governed by
automatic provisioning entitlement
cannot be orphaned.
Explanation: One or more of the selected accounts
cannot be deleted. The account specified is created
automatically and must exist for proper processing.
This account is recreated if deleted.
Administrator response: Remove the account from the
list of accounts to be orphaned.
CTGIMI022E
The synchronized password can not
be reused for this new account.
Explanation: The synchronized password can not be
reused since it does not conform the password rule of
the new account.
User response: Specify a password that conforms to
the password rules related to this account.
CTGIMI023E
The account cannot be modified
because there is no entitlement
associated with the account.
Explanation: To change an account, there must be a
provisioning policy associated with the account.
User response: Check that a provisioning policy
governs the account.
Messages
73
CTGIMI024E • CTGIMI037E
CTGIMI024E
The default provisioning parameters
cannot be evaluated for the account.
CTGIMI032E
You are not entitled to remove access
for access_name.
Explanation: The provisioning policy engine cannot
generate the default parameters.
Explanation: The request to remove access is not
entitled in the provisioning policy.
User response: Ensure that the parameters in the
Account form to provision a new account are specified.
User response: Please make necessary updates to the
provisioning policy for granting remove access.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMI033E
CTGIMI025E
The service of an account cannot be
changed.
Explanation: When modifying an account, the service
to which the account is associated cannot be modified.
Programmer response: To modify other account
attributes, perform the modification again without
modifying the service.
CTGIMI027E
The owner or service of an account
cannot be changed.
Explanation: When modifying an account, the owner
or service of the account cannot be modified.
Programmer response: To modify other account
attributes, perform the modification again without
modifying the owner or service.
CTGIMI029E
The account_name account cannot be
transferred.
Explanation: The account owner for the IBM Security
Privileged Identity Manager account cannot be
removed.
Programmer response: Verify that the account is not
an account managed by IBM Security Privileged
Identity Manager.
CTGIMI030E
Disallowed account cannot be
transferred if the enforcement action is
Correct. The account name is
account_name.
You do not have the authority to
perform this operation for access_name.
Explanation: An access control item does not allow
you to perform the specified operation.
User response: Contact your system administrator to
obtain the authority to perform the operation.
CTGIMI034E
You do not have the authority to
perform this operation for access_name.
Explanation: An access control item does not allow
you to perform the specified operation.
User response: Contact your system administrator to
obtain the authority to perform the operation.
CTGIMI035E
You are not entitled to add account
account_id owned by owner_name to
group_name group.
Explanation: Provisioning policies must entitle you to
be able to add members to a group. You are not
currently entitled.
User response: Update the provisioning policy to
allow you to add a member to this group.
CTGIMI036E
You are not entitled to remove account
account_id owned by owner_name from
group_name group.
Explanation: Provisioning policies must entitle you to
be able to remove members from a group. You are not
currently entitled.
User response: Update the provisioning policy to
allow you to remove a member from this group.
Explanation: Disallowed account cannot be transferred
if the enforcement action is Correct.
CTGIMI037E
User response: Make sure the account is not
disallowed by the provisioning policy if the
enforcement action is Correct.
Explanation: An access control item does not allow
you to add group members to this group.
CTGIMI031E
You are not entitled to request access
for access_name.
User response: Contact your system administrator to
obtain the authority to perform the operation.
Explanation: The request to add access is not entitled
in the provisioning policy.
User response: Please make necessary updates to the
provisioning policy for granting request access.
74
You do not have the authority to add
group members to the group_name group.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMI038E • CTGIMI049E
CTGIMI038E
You do not have the authority to
remove group members from the
group_name group.
Explanation: An access control item does not allow
you to remove group members from this group.
User response: Contact your system administrator to
obtain the authority to perform the operation.
CTGIMI039W Adding account_id owned by
owner_name to group_name does not
comply with policy.
Explanation: Provisioning policies must allow you to
be able to add members to a group. You are not
currently allowed.
User response: Update the provisioning policy to
allow you to add a member to this group.
CTGIMI040W Removing account_id owned by
owner_name from group_name does not
comply with policy.
Explanation: Provisioning policies must allow you to
be able to remove members from a group. You are not
currently allowed.
User response: Update the provisioning policy to
allow you to remove a member from this group.
CTGIMI041E
The group profile profile_name could
not be found.
Explanation: The group profile does not exist in the
LDAP server.
Programmer response: Verify that the group profile
name was spelled and entered correctly. If the group
profile name was entered correctly, ensure that you
have installed the service profile.
CTGIMI042W Group management operations
cannot be performed for profile_name.
Explanation: The group profile does not have the
group management feature enabled.
Programmer response: Enable the group management
feature for the group profile. Ensure that the group
profile has attribute ercustomproperties of value
Managed=true.
CTGIMI043E
group_id group has members.
Explanation: You cannot remove a group that has
members.
User response: Remove the members from the group
first, then remove the group.
CTGIMI044E
group_id group already exists on
service_name.
Explanation: The group ID has to be unique for a
service.
User response: Verify that the group ID was spelled
correctly. If it was not, reenter the group ID and try
again. If it was spelled correctly and that group ID
does already exist on the service, use a different group
ID that does not exist on the service and try again.
CTGIMI045E
group_id group is referred by the
following provisioning policies:
policy_list.
Explanation: You cannot remove a group that is
referred by any provisioning policies.
User response: Remove the group from the
provisioning policy entitlement parameters first, then
remove the group.
CTGIMI046E
You cannot change the value of the
attribute that is mapped to
groupid_attr_name.
Explanation: The attribute is used to uniquely identify
the group. Its value cannot be changed.
User response: Do not attempt to change the value of
the attribute.
CTGIMI047E
Account user_id is not owned by
user_name.
Explanation: Processing cannot continue because the
user does not own the specified account. The account
might have been orphaned or transferred to another
user.
User response: Verify the ownership of the account
and ensure that this function only processes accounts
owned by the specified user.
CTGIMI048E
Account user_id does not have an
owner and cannot be processed.
Explanation: The specified account does not have an
owner. Processing cannot continue because this
function can only process accounts that have an owner.
User response: Verify the ownership of the account
and ensure that this function only processes accounts
with an owner.
CTGIMI049E
The ownership type of an account
cannot be changed.
Explanation: When modifying an account, the
ownership type of the account cannot be modified.
Programmer response: To modify other account
Messages
75
CTGIMI050E • CTGIMI061E
attributes, perform the modification again without
modifying the ownership type.
CTGIMI050E
group_id group is referred by the
following shared access pool: pool_list.
verify the provisioning policies that are defined for the
access. Then try the operation again.
CTGIMI056W The user is not authorized to have
access_name access on service_name.
Explanation: You cannot remove a group that is
referred by any shared access pool.
Explanation: There is no policy granting the requested
access for the user.
User response: Remove the group from the shared
access policy first, then remove the group.
User response: You can proceed to request the access.
The account that is created will be marked as
non-compliant; a compliance alert may be generated
depending on the system settings.
CTGIMI051E
Additional information is required for
the access requested.
Explanation: When requesting access to a system or
application, you must provide additional information.
CTGIMI057W The user already has the requested
access access_name on the service_name
service with account(s) account_names.
User response: Fill in the required information before
submitting the access request.
Explanation: The user already has the access.
CTGIMI052E
Access request validators could not be
created.
Explanation: System errors occurred while trying to
create access request validators.
User response: Contact your system administrator to
ensure that the system and the ISPIM application are
running properly.
CTGIMI053E
You are not authorized to add an
account for the service_name service.
Explanation: You do not have the correct permissions
to perform this operation.
User response: Contact your system administrator to
obtain the authority to add account on this service.
Then try the operation again.
Administrator response: Grant Add account
permission for the service account type to this user
CTGIMI054E
You are not authorized to add a group
member for service_name service.
User response: The user already has the access being
requested. We would still provision your access request
unless you remove it.
CTGIMI058W Your request for access has caused
separation of duty policy violations. The
set of roles that conflict with [rule_name]
are access_or_role_name.
Explanation: Your request cannot be completed. The
roles that you requested for the person are conflicting.
User response: Remove some roles in order to resolve
the conflict. Then try the request again.
CTGIMI059E
An account attribute compliance
violation was detected. Account:
account_uid, service: service_name.
Explanation: The account is not compliant with one or
more governing policies.
User response: Ensure that the account is created
using compliant attribute values or ask your system
administrator for help.
The informaion requeset_data specified
in the access request is not valid.
Explanation: You do not have the correct permissions
to perform this operation.
CTGIMI060E
User response: Contact your system administrator to
obtain the authority to add a group member on this
service. Then try the operation again.
Explanation: You requested access to a system or
application, but the information specified in the access
request is not valid.
Administrator response: Grant Add member to group
permission for the service account type to this user
Programmer response: Review the API documentation
to ensure that the access request data is defined
correctly.
CTGIMI055E
The user is not authorized to have
access_name access on service_name.
Explanation: There is no policy granting the requested
access for the user.
User response: Contact your system administrator to
76
CTGIMI061E
The synchronized password for
person_name is not valid.
Explanation: The synchronized password for the
person does not comply with the password policies in
the system.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMI062E • CTGIMI073E
User response: Review the password rules and enter a
new password.
attributes; or contact a system administrator to grant
write permission for the required attributes.
CTGIMI062E
CTGIMI068E
The password for the new account on
service_name is not valid.
Operation ( permission ) is not allowed
for attributes ( attrList ).
Explanation: The password for the new account does
not comply with the password policies in the system.
Explanation: The operation is not allowed for the
attributes listed.
User response: Review the password rules and enter a
new password.
Programmer response: Ensure that the attribute
operation has the correct access control.
CTGIMI063E
CTGIMI069E
The access provisioning authority
JAVA class class_name is not valid.
There are non-compliant attributes on
service_name.
Explanation: The access provisioning authority JAVA
class does not support the required JAVA interface.
Explanation: Some attributes of the account do not
comply with the provisioning policy.
Programmer response: Please review API
documentation to ensure that proper interface is
implemented.
User response: Modify the attribute values and make
them compliant.
CTGIMI070E
CTGIMI064E
The access cannot be provisioned on
the service_name service because the user
does not have any accounts on the
prerequisite prereq_service_name service.
Explanation: The access cannot be provisioned on the
service if user does not have accounts on the
prerequisite service. Make sure that the prerequisite
service is included in the same access request. If the
prerequisite service is not displayed in the access list,
contact the system administrator to obtain access
permission.
User response: Add the prerequisite service to the
access request. If the prerequisite service does not show
up, contact the system administrator to obtain access
permission.
CTGIMI065E
Access catalog entry access_info is not
valid.
Explanation: The access catalog entry is not valid
Programmer response: Please review API
documentation to ensure that proper interface is used.
CTGIMI066E
The obligation data (ID= obligationId )
is not valid.
Explanation: The obligation data referenced by the ID
does not match the expected type.
Programmer response: Review the API documentation
to ensure that the correc interface is used.
CTGIMI067W The required attributes attrList are
missing.
The user already has the requested
access access_name.
Explanation: The user already has the access that you
requested.
User response: The user already has the access being
requested. Remove the access from request list.
CTGIMI071E
The user already has the requested
access accessNameList on all existing
account(s) for the service_name service.
Explanation: The user already has the access on all
existing accounts for the service.
User response: The user already has the access on all
existing accounts for the service. Remove the access
from request list.
CTGIMI072W There are non-compliant attributes on
service_name.
Explanation: Some attributes of the account do not
comply with the provisioning policy.
User response: Modify the attribute values and make
them compliant.
CTGIMI073E
Cannot find the entity entity_name to
be defined as an access using access
bulk load.
Explanation: Cannot find the entity where the access
is defined. This entity might already be deleted.
User response: Check to see if the specified entity
exists.
Explanation: The required attributes are missing.
User response: Provide information for the missing
Messages
77
CTGIMI074E • CTGIMI085E
CTGIMI074E
The icon URL defined for entity_name
using the access bulk load is not valid.
CTGIMI080E
Explanation: The icon URL that is defined for the
access is not valid.
User response: Define a valid URL for the access icon
that is to be associated with the access.
CTGIMI075E
The Service service_name is a feed type
service and cannot be defined as an
access.
Explanation: The service is of feed type and cannot be
defined as an access.
User response: The service cannot be defined as an
access.
CTGIMI076E
An access name is not provided for
entity_name in the access data CSV input
file.
Explanation: Cannot define the entity as an access
because an access name was not provided.
User response: Provide an access name for the entity
in the access data CSV input file.
CTGIMI077E
An access type was not provided for
entity_name in the access data CSV input
file.
The additional information that is
defined for entity_name in the access
data CSV input file exceeds maxLength
characters.
Explanation: The additional information length
exceeds the maximum character limit.
User response: Provide additional information that
complies with the maximum length requirement in the
access data CSV input file.
CTGIMI081E
The badge text that is defined for
entity_name in the access data CSV input
file exceeds maxLength characters.
Explanation: The badge text length exceeds the
maximum character limit.
User response: Provide a badge text that complies
with the maximum length requirement in the access
data CSV input file.
CTGIMI082E
The search term that is defined for
entity_name exceeds maxLength characters.
Explanation: The search term length exceeds the
maximum character limit.
User response: Provide search terms that complies
with the maximum length requirement in the access
data CSV input file.
Explanation: Cannot define the entity as an access
because an access type was not provided.
CTGIMI083E
User response: Provide an access type for the entity in
the access data CSV input file.
Explanation: The access type does not exist.
CTGIMI078E
The access name that is defined for
entity_name in the access data CSV input
file exceeds maxLength characters.
Explanation: The access name length exceeds the
maximum character limit.
User response: Provide an access name that complies
with the maximum length requirement in the access
data CSV input file.
CTGIMI079E
The access description that is defined
for entity_name in the access data CSV
input file exceeds maxLength characters.
Explanation: The access description length exceeds the
maximum character limit.
User response: Provide an access description that
complies with the maximum length requirement in the
access data CSV input file.
The access type that is defined for
entity_name does not exist.
User response: Provide an access type that exists, or
create the access type before defining it in the access
data CSV file. If the key for the label of an access type
is used, then verify that the key is accurate. Try the
operation again.
CTGIMI084W There are more than five badges
defined for entity_name.
Explanation: The number of badges that you defined
for the entity access exceeded the maximum limit of
five badges.
User response: If any of the required badges have not
been added to the access, update the access information
with the required badges.
CTGIMI085E
The import file is empty.
Explanation: The file that you are importing is empty.
The import file must contain the required data.
User response: Provide an appropriate import file,
and then try the operation again.
78
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMI086E • CTGIMI096E
CTGIMI086E
The total number of columns that are
specified in the CSV file is not correct.
Explanation: The total number of columns that are
specified in the CSV file is not correct. Verify that the
CSV file contains the correct columns.
User response: Provide the import file with correct
columns, and then try the operation again.
CTGIMI087E
The entries in the CSV file are either
not correct or not in the appropriate
order.
Explanation: The CSV file cannot be processed. The
header labels might be incorrect, or the columns in the
CSV file might not be in the appropriate order.
User response: Verify that the header labels and the
order of the entries in the CSV file are correct, and then
try the operation again.
CTGIMI088E
The CSV entries at line number
linenumber are not correct.
Explanation: The number of comma-separated entries
is different from the total number of columns in the
CSV file.
User response: Provide the correct entries in the CSV
file.
CTGIMI089E
One or more record entries with the
same DN name exist in the CSV file.
CTGIMI092E
The logged in user is not authorized
to modify the entity entity_name.
Explanation: The logged in user does not have the
correct permissions to modify the specified entity.
User response: Verify if user has the correct
permissions to modify the specified entity. Contact your
administrator to obtain the authority to modify the
specified entity. Try the operation again.
CTGIMI093E
The CSV file that you imported is for
the entity actual_entity_name. Specify the
valid CSV file for the entity
expected_entity_name.
Explanation: The CSV file that you imported is not
valid for the specified entity. The specified upload file
must be a valid CSV file.
User response: Make sure that you import the valid
CSV file for the expected entity type in the Import
Access Data page, and try the operation again.
CTGIMI094E
The runtime library to support regular
expression in database queries is
missing.
Explanation: The runtime library to support regular
expression in database queries is missing. Search for
regular repression support in Information Center, and
follolw the manual steps to configure runtime library to
support regular expression for your database.
Explanation: If a specified record entry exists, then
similar entries cannot be added. Check the CSV file for
similar or duplicate entries.
CTGIMI095E
User response: Provide a unique entry in the CSV file
to continue, and then try the operation again.
Explanation: The logged in user does not have the
correct permissions to read the access options for the
specified entity.
CTGIMI090E
User response: Verify if the user has the correct
permissions to read the access options. Contact your
administrator to obtain the authority to read the
specified entity. Try the operation again.
The badge format that is defined for
entity_name is not valid.
Explanation: The badge is not defined correctly in the
access data CSV input file.
User response: Define the badge in the CSV file by
using a valid format. The valid badge format is
badgeText~badgeStyle.
CTGIMI091E
User ID user_id is already in use on
the service_name service. Specify another
user ID.
Explanation: The specified user ID is already defined
for the service.
User response: Specify a different user ID, and try the
operation again.
CTGIMI096E
The logged in user is not authorized
to read the access options for the entity
entity_name.
The key key_name for the customized
badge text that is defined for entity_name
contains invalid delimiter characters
such as ., :, = or white space.
Explanation: The key for the customized badge text
cannot contain invalid delimiter characters such as ., :,
=, or white space.
User response: Remove all the invalid characters from
the customized badge text and then try the operation
again.
Messages
79
CTGIMI097W • CTGIMJ106E
CTGIMI097W The property_name property of entity
entity_name cannot be modified.
Explanation: The specified property of the entity
cannot be modified.
User response: The property modification has been
ignored.
CTGIMI099E
The new account information on
service_access_name contains validation
errors. You must correct these errors
before you can submit your request.
Explanation: Some of the account data violate the
constraints that are set on the attributes.
User response: Correct the account data to resolve the
constraint violations and submit the access request
again.
CTGIMI100E
The attribute attribute_name cannot be
null.
Explanation: The account requires that the specified
attribute must have a value. This message is displayed
when the attribute value is missing.
User response: Ensure that the specified attribute has
a valid value.
Form customization messages
CTGIMJ100E
The form contains validation errors.
CTGIMJ104E
Explanation: Errors were found while validating the
form.
User response: Correct the errors that are specified in
the individual validation messages, then submit the
form again. Review the IBM Security Privileged
Identity Manager log files for more information.
CTGIMJ101E
You are not authorized to manage
forms.
Explanation: You do not have the authority to manage
forms.
User response: Contact your system administrator to
obtain the authority to manage forms.
CTGIMJ102E
The field_name field contains characters
that are not valid.
Explanation: The specified field contains a bit string
that is not formatted correctly.
User response: Ensure that the value meets the syntax
requirements of the field, and try the operation again.
If you cannot determine the correct syntax, contact
your system administrator.
Administrator response: Ensure that the value meets
the syntax requirements of the specified field, and try
the operation again. If you cannot determine the correct
syntax, ensure that the correct type of widget is being
called to process a binary bit string.
CTGIMJ105E
Explanation: The specified field contains characters
that are not valid.
User response: Ensure that each field contains valid
information, and try the operation again. The
implementer of the design form specifies which
characters are valid.
CTGIMJ103E
The field_name field on the tab_name
tab contains characters that are not
valid.
Explanation: The specified field on the specified tab
contains characters that are not valid.
User response: Ensure that each field on the specified
tab contains valid information, and try the operation
again. The implementer of the design form specifies
which characters are valid.
The value specified in the field_name
field does not have the correct format.
Specify a bit string using the following
format: '101010'B
The value specified in the field_name
field on the tab_name tab does not have
the correct format. Specify a bit string
using the following format: '101010'B
Explanation: The specified field contains a bit string
that is not formatted correctly.
User response: Ensure that the value meets the syntax
requirements of the field, and try the operation again.
If you cannot determine the correct syntax, contact
your system administrator.
Administrator response: Ensure that the value meets
the syntax requirements of the specified field, and try
the operation again. If you cannot determine the correct
syntax, ensure that the correct program widget is called
to process the bit string.
CTGIMJ106E
The value specified in the field_name
field does not have the correct format.
Specify a TRUE or FALSE Boolean value
using the following syntax: 'true' or
'false'
Explanation: The specified field requires a valid
80
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMJ107E • CTGIMJ113E
Boolean value of either TRUE or FALSE, in the format
shown in the message.
CTGIMJ110E
User response: Enter a value of either TRUE or FALSE
in the format shown in the message, and try the
operation again. If you cannot determine the correct
syntax, contact your system administrator.
Explanation: At least one field contains a domain
name that is not valid. The field can be either an e-mail
field or a domain name field.
Administrator response: Ensure that the Boolean
value meets the syntax requirements of the field, and
try the operation again. If you cannot determine the
correct syntax, ensure that the correct program widget
is called to process the specified value.
CTGIMJ107E
The value specified in the field_name
field on the tab_name tab does not have
the correct format. Specify a TRUE or
FALSE Boolean value using the
following syntax: 'true' or 'false'
Explanation: The specified field requires a valid
Boolean value of either TRUE or FALSE, in the format
shown in the message.
User response: Enter a value of either TRUE or FALSE
in the format shown in the message, and try the
operation again. If you cannot determine the correct
syntax, contact your system administrator.
Administrator response: Ensure that the Boolean
value meets the syntax requirements of the field, and
try the operation again. If you cannot determine the
correct syntax, ensure that the correct program widget
is called to process the specified value.
CTGIMJ108E
The date specified in the field_name
field is not valid. The date must be later
than the date set in the field_name field.
Explanation: The specified date is not valid. If you
cannot determine the format of the date, ask your
system administrator. The format of the field is
specified in the design form.
User response: Ensure that the domain name is
specified correctly, and try the operation again. A
domain name must begin with two backslashes and
must not exceed a total length of 15 characters. The
following characters cannot be used in a domain name:
Double quotation mark Single quotation mark or
apostrophe Less than sign (<) Greater than sign (>)
Forward slash Backslash (except the backslashes used
as part of the domain name syntax) Square brackets
Colon Semicolon Vertical bar Equal sign Comma Plus
sign Asterisk Question mark
CTGIMJ111E
The date specified in the field_name
field on the tab_name tab is not valid.
The date must be later than the date set
in the field_name field.
Explanation: The specified date is not valid. If you
cannot determine the format of the date, ask your
system administrator. The format of the field is
specified in the design form.
User response: Ensure that the date is specified
correctly, and try the operation again.
A field contains a domain name with
a format that is not valid.
Explanation: At least one field contains a domain
name that is not valid. The field can be either an e-mail
field or a domain name field.
User response: Ensure that the domain name is
specified correctly, and try the operation again. A
domain name must begin with two backslashes and
must not exceed a total length of 15 characters. The
following characters cannot be used in a domain name:
Double quotation mark Single quotation mark or
apostrophe Less than sign (<) Greater than sign (>)
Forward slash Backslash (except the backslashes used
as part of the domain name syntax) Square brackets
Colon Semicolon Vertical bar Equal sign Comma Plus
sign Asterisk Question mark
CTGIMJ112E
User response: Ensure that the date is specified
correctly, and try the operation again.
CTGIMJ109E
A field contains a domain name with
a format that is not valid.
The value in the field_name field on
the tab_name tab is not valid. The value
must be in the following format, where
YYYY specifies the year, MM specifies
the month, DD specifies the day, HH
specifies the hour, MM specifies the
minute, and Z specifies the time zone:
YYYYMMDDHHMMZ
Explanation: The date is specified in the wrong
format. If you cannot determine the format of the date,
ask your system administrator. The format of the field
is specified in the design form.
User response: Ensure that the date is formatted
correctly, and try the operation again.
CTGIMJ113E
The value in the field_name field is not
valid. The value must be in the
following format, where YYYY specifies
the year, MM specifies the month, DD
specifies the day, HH specifies the hour,
MM specifies the minute, and Z
specifies the time zone:
Messages
81
CTGIMJ114E • CTGIMJ121E
YYYYMMDDHHMMZ
Explanation: The date is specified in the wrong
format. If you cannot determine the format of the date,
ask your system administrator. The format of the field
is specified in the design form.
User response: Ensure that the date is formatted
correctly, and try the operation again.
CTGIMJ114E
The field_name field contains an IPv4
address that is not valid.
Explanation: At least one IPv4 field contains an
improperly formatted IP address. An IPv4 address has
4 parts, and each part must be separated by a period (.)
delimiter, for example 24.194.231.8. Each part can
contain an integer value in the range 0-255.
User response: Correct the IP address, and try the
operation again.
CTGIMJ115E
The field_name field on the tab_name
tab contains an IPv4 address that is not
valid.
User response: Correct the IP address, and try the
operation again.
CTGIMJ118E
The field name field contains an IPv6
address that is not valid.
Explanation: At least one IP version 6 (IPv6) field
contains IP address information that is not valid. An
IPv6 address is a 128 bit address in eight 16-bit
hexadecimal parts. Each part is separated by a colon:
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx Each
individual x represents a 4-bit hexadecimal value in the
range 0-F. Example:
5F05:2000:80AD:5800:0048:0800:2053:1D71
User response: Correct the IPv6 address, and try the
operation again.
CTGIMJ119E
The field name field on the tab_name
tab contains an IPv6 address that is not
valid.
Explanation: At least one IPv4 field contains an
improperly formatted IP address. An IPv4 address has
4 parts, and each part must be separated by a period (.)
delimiter, for example 24.194.231.8. Each part can
contain an integer value in the range 0-255.
Explanation: At least one IP version 6 (IPv6) field
contains IP address information that is not valid. An
IPv6 address is a 128 bit address in eight 16-bit
hexadecimal parts. Each part is separated by a colon:
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx Each
individual x represents a 4-bit hexadecimal value in the
range 0-F. Example:
5F05:2000:80AD:5800:0048:0800:2053:1D71
User response: Correct the IP address, and try the
operation again.
User response: Correct the IPv6 address, and try the
operation again.
CTGIMJ116E
The field_name field contains an IP
address that is outside the valid range
for IPv4 addresses. The valid range for
each part of an IP address is 0-255.
Explanation: At least one field contains an IP address
that is outside the valid range for IPv4 addresses. An
IPv4 address has 4 parts, and each part must be
separated by a period (.) delimiter, for example
24.194.231.8. Each part can contain an integer value in
the range 0-255.
User response: Correct the IP address, and try the
operation again.
CTGIMJ117E
The field_name field on the tab_name
tab contains an IP address that is
outside the valid range for IPv4
addresses. The valid range for each part
of an IP address is 0-255.
Explanation: At least one field contains an IP address
that is outside the valid range for IPv4 addresses. An
IPv4 address has 4 parts, and each part must be
separated by a period (.) delimiter, for example
24.194.231.8. Each part can contain an integer value in
the range 0-255.
82
CTGIMJ120E
The format of a domain name in one
or more fields is not valid.
Explanation: A domain name must begin with two
backslashes (\\).
User response: Ensure that the domain name is
specified correctly and try the operation again. A
domain name must begin with two backslashes and
must not exceed a total length of 15 characters. The
following characters cannot be used in a domain name:
double quotation mark single quotation mark or
apostrophe less than sign (<) greater than sign (>)
forward slash backslash (except the backslashes used as
part of the domain name syntax) square brackets colon
semicolon vertical bar equal sign comma plus sign
asterisk question mark
Administrator response: Ensure that the domain
name meets the specification criteria and try the
operation again.
CTGIMJ121E
The field_name field on the tab_name
tab contains a domain name that is not
valid.
Explanation: A domain name must begin with two
backslashes and must not exceed a total length of 15
characters. The following characters cannot be used in a
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMJ122E • CTGIMJ130E
domain name: double quotation mark single quotation
mark or apostrophe less than sign (<) greater than sign
(>) forward slash backslash (except the backslashes
used as part of the domain name syntax) square
brackets colon semicolon vertical bar equal sign comma
plus sign asterisk question mark
Administrator response: Ensure that the domain
name is specified correctly and try the operation again.
User response: Ensure that all fields contain valid
(printable) characters, and try the operation again. If
you used a cut-paste operation to enter the characters,
ensure that no invisible characters are included.
Localization (type of language used) can also affect the
validity of the characters. Non-US English characters
are outside of the range for standard ASCII characters.
CTGIMJ127E
CTGIMJ122E
The format of the e-mail address is
not valid.
Explanation: At least one field requires an e-mail
address in the format user_name@email_address.
Administrator response: Ensure that the e-mail
address is specified in the correct format, and try the
operation again.
CTGIMJ123E
The format of the e-mail address is
not valid.
Explanation: At least one field requires an e-mail
address in the format user_name@email_address.
Administrator response: Ensure that the e-mail
address is specified in the correct format, and try the
operation again.
Explanation: The specified field contains one or more
characters that cannot be processed, for example a line
return character that cannot be printed. The following
characters can be used: Numbers: 0 through 9 (no
decimal values) Letters: A through Z (either lowercase
or uppercase) Special characters: ~ ! @ # $ % ^ & * ( ) _
+ - [ ] { } | ' : , . / < > ? \ SPACE
User response: Ensure that all fields contain valid
(printable) characters, and try the operation again. If
you used a cut-paste operation to enter the characters,
ensure that no invisible characters are included.
Localization (type of language used) can also affect the
validity of the characters. Non-US English characters
are outside of the range for standard ASCII characters.
CTGIMJ128E
CTGIMJ124E
An e-mail field contains a user name
as part of the e-mail address that is not
valid.
Explanation: At least one e-mail field contains a user
name that is not valid. The user name cannot start or
end with an underscore (_) or a dash (-).
The field_name field on the tab_name
tab can contain only ASCII characters.
Non-ASCII characters were found.
The field_name field contains at least
one character that is not an integer.
Specify only integers in this field.
Explanation: At least one numeric field contains a
value that is not a whole number (integer).
User response: Correct the user name in the e-mail
address, and try the operation again.
User response: Ensure that each numeric field that
requires an integer value contains an whole number in
the valid range for the field, and try the operation
again.
CTGIMJ125E
CTGIMJ129E
An e-mail field contains a user name
as part of the e-mail address that is not
valid.
Explanation: At least one e-mail field contains a user
name that is not valid. The user name cannot start or
end with an underscore (_) or a dash (-).
User response: Correct the user name in the e-mail
address, and try the operation again.
CTGIMJ126E
The field_name field can contain only
ASCII characters. Non-ASCII characters
were found.
Explanation: The specified field contains one or more
characters that cannot be processed, for example a line
return character that cannot be printed. The following
characters can be used: Numbers: 0 through 9 (no
decimal values) Letters: A through Z (either lowercase
or uppercase) Special characters: ~ ! @ # $ % ^ & * ( ) _
+ - [ ] { } | ' : , . / < > ? \ SPACE
The field_name field on the tab_name
tab contains at least one character that is
not an integer. Specify only integers in
this field.
Explanation: At least one numeric field contains a
value that is not a whole number (integer).
User response: Ensure that each numeric field that
requires an integer value contains an whole number in
the valid range for the field, and try the operation
again.
CTGIMJ130E
The field_name field contains at least
one non-numeric character. Specify only
numbers in this field.
Explanation: The specified numeric field contains a
value that is not numeric.
User response: Ensure that each numeric field
contains only a numeric value, and try the operation
again.
Messages
83
CTGIMJ131E • CTGIMJ141E
CTGIMJ131E
The field_name field on the tab_name
tab contains at least one non-numeric
character. Specify only numbers in this
field.
Explanation: The specified numeric field contains a
value that is not numeric.
User response: Ensure that each numeric field
contains only a numeric value, and try the operation
again.
CTGIMJ136E
Explanation: The specified field contains more lines
than the maximum number of lines allowed.
User response: Reduce the number of lines in the field
to a value that is less than or equal to the maximum
value allowed, and try the operation again.
CTGIMJ137E
CTGIMJ132E
The number of characters in the
field_name field is less than the
minimum number (minimum_value)
required.
Explanation: The specified field contains fewer
characters than the minimum number of characters
required.
User response: Ensure that each field contains a value
in the valid range for the field and try the operation
again.
CTGIMJ133E
The number of characters in the
field_name field on the tab_name tab is
less than the minimum number
(minimum_value) required.
Explanation: The specified field contains fewer
characters than the minimum number of characters
required.
User response: Ensure that each field contains a value
in the valid range for the field and try the operation
again.
CTGIMJ134E
The number of characters in the
field_name field is greater than the
maximum number (maximum_value)
allowed.
Explanation: The specified field contains more
characters than the maximum number of characters
allowed.
User response: Ensure that each field contains a value
in the valid range for the field and try the operation
again.
CTGIMJ135E
The number of characters in the
field_name field on the tab_name tab is
greater than the maximum number
(maximum_value) allowed.
The number of lines in the field_name
field is greater than the maximum
number (maximum_lines) allowed.
The number of lines in the field_name
field on the tab_name tab is greater than
the maximum number (maximum_lines)
allowed.
Explanation: The specified field contains more lines
than the maximum number of lines allowed.
User response: Reduce the number of lines in the field
to a value that is less than or equal to the maximum
value allowed, and try the operation again.
CTGIMJ138E
No value is specified in the field_name
field. This field is required.
Explanation: The specified required field is missing a
value.
User response: Ensure that all required fields have
values, and try the operation again.
CTGIMJ139E
No value is specified in the field_name
field on the tab_name tab. This field is
required
Explanation: The specified required field is missing a
value.
User response: Ensure that all required fields have
values, and try the operation again.
CTGIMJ140E
The e-mail address in the field_name
field must contain an @ sign.
Explanation: The address field has an e-mail address
that is not valid because it does not contain an @
character.
User response: Correct the address, and try the
operation again.
CTGIMJ141E
The e-mail address in the field_name
field on the tab_name tab must contain
an @ sign.
Explanation: The specified field contains more
characters than the maximum number of characters
allowed.
Explanation: The specified address field has an e-mail
address that is not valid because it does not contain an
@ character.
User response: Ensure that each field contains a value
in the valid range for the field and try the operation
again.
User response: Correct the address, and try the
operation again.
84
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMJ142E • CTGIMK001E
CTGIMJ142E
The field_name field must contain at
least one period delimiter (.) in the IP
address.
Explanation: The specified field contains an IP address
that is not valid because it does not include periods as
address delimiters.
User response: Ensure that the field has a valid IP
address, and try the operation again.
CTGIMJ143E
The field_name field on the tab_name
tab must contain at least one period
delimiter (.) in the IP address.
Explanation: The specified field contains an IP address
that is not valid because it does not include periods as
address delimiters.
User response: Ensure that the field has a valid IP
address, and try the operation again.
CTGIMJ144E
The field_name field cannot contain
any spaces.
Explanation: The specified field contains a space
character that is not allowed.
User response: Remove the space from the field, and
try the operation again.
CTGIMJ145E
The field_name field on the tab_name
tab cannot contain any spaces.
Explanation: The specified field contains a space
character that is not allowed.
User response: Remove the space from the field, and
try the operation again.
CTGIMJ146E
The value that is specified in the
field_name field is less than the allowed
minimum value of minimum_value.
Explanation: The specified field contains a value that
is less than the allowable minimum value for that field.
User response: Specify a value within the allowable
range for each numeric field, and try the operation
again.
CTGIMJ148E
The value that is specified in the
field_name field exceeds the allowed
maximum value of maximum_value.
Explanation: The specified numeric field contains a
value that is greater than the allowable maximum value
for that field.
User response: Specify a value within the allowable
range for each numeric field, and try the operation
again.
CTGIMJ149E
The value that is specified in the
field_name field on the tab_name tab
exceeds the allowed maximum value of
maximum_value.
Explanation: The specified numeric field contains a
value that is greater than the allowable maximum value
for that field.
User response: Specify a value within the allowable
range for each numeric field, and try the operation
again.
CTGIMJ150E
The field_name field contains a DN
that is not valid.
Explanation: The specified field contains a value that
is not a DN.
User response: Correct the DN, and try the operation
again.
CTGIMJ151E
The field_name field on the tab_name
tab contains a DN that is not valid.
Explanation: The specified field contains a value that
is less than the allowable minimum value for that field.
Explanation: The specified field contains a value that
is not a DN.
User response: Specify a value within the allowable
range for each numeric field, and try the operation
again.
User response: Correct the DN, and try the operation
again.
CTGIMJ147E
The value that is specified in the
field_name field on the tab_name tab is
less than the allowed minimum value of
minimum_value.
Import and export management messages
CTGIMK001E The container_name container cannot
be found.
Administrator response: Create the same container
hierarchy in the target system, as the source system,
and then try to import.
Explanation: The container which contains objects on
the source system, is not present in the target system.
Messages
85
CTGIMK002E • CTGIMK014E
CTGIMK002E The index index is used to retrieve an
incorrect property.
CTGIMK009E Selected Entity Profile(s) has/have
dependent data. Removal is not allowed
Explanation: Bad Index used while retrieving a
property in the code.
Explanation: Trying to delete profile(s) that has
dependent data is not allowed.
Programmer response: A property is being retrieved
from the BasicDataObject without setting the property.
Make sure the property is being set for successful
retrieval.
Administrator response: Please make sure that there
is no dependent data before deleting the profile(s).
CTGIMK003E The object_name object of type
object_type cannot be found in the
container_name container.
Explanation: A dependent is not present which is
being referred by another object.
Administrator response: Add the dependent object
during export or add it manually to the target system.
CTGIMK004E The profile_name profile cannot be
found.
Explanation: A profile is not present which is being
referred by another object.
CTGIMK010E An error occurred while processing
the import.
Explanation: The import jar file may be corrupt or the
contents may not be expected by the import process.
Administrator response: Verify the integrity of the
import jar file, or run a clean export from a system that
contains the configuration you wish to import, then try
the import again using a clean export jar.
CTGIMK011E An error occurred while fetching the
list of imports.
Explanation: The database may be down or the server
may be unable to connect to it.
Administrator response: Add the profile during
export or install it manually to the target system.
Administrator response: Verify that the server is able
to get a connection to the database and run a basic
database query, then refresh the list of imports.
CTGIMK005E An error occurred retrieving the
directory context.
CTGIMK012E An error occurred while fetching the
list of imports.
Explanation: Directory context could not be created
while retrieving schema.
Explanation: The database may be down or the server
may be unable to connect to it.
Administrator response: Verify that the connection to
directory server exists.
Administrator response: Verify that the server is able
to get a connection to the database and to run a basic
database query, then refresh the list of imports.
CTGIMK006E An error occurred reading the
file_name property file.
Explanation: The property file is not found.
Administrator response: Add the property file to the
system and then try the operation again.
CTGIMK007E
Unable to retrieve the data.
Explanation: Communication with the ldap can't be
established.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMK008E
Cannot add an Entity Profile
Explanation: Failed to create a new entity profile.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
86
CTGIMK013E An error occurred while
deleting/removing the import process.
Explanation: The database may be down or the server
may be unable to connect to it.
Administrator response: Verify that the server is able
to get a connection to the database and to run a basic
database query, then try deleting the import process
again.
CTGIMK014E An error occurred while fetching the
list of exports.
Explanation: The database may be down or the server
may be unable to connect to it.
Administrator response: Verify that the server is able
to get a connection to the database and to run a basic
database query, then refreshing the list of exports again.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMK015E • CTGIMK026E
CTGIMK015E An error occurred while executing the
export.
Explanation: The export process connects to the
directory and to the database, either one may be down
or the server may be unable to connect.
Administrator response: Verify that the server is able
to get a connection to the database and to the directory
and to run a basic database query and/or directory
lookup, then try executing the export again.
CTGIMK016E An error occurred while downloading
the export jar file.
Explanation: The operation may have timed out or the
server may be unable to connect to the database.
Administrator response: Verify that the server is able
to get a connection to the database and to run a basic
database query, then try downloading the export jar
again.
CTGIMK017E An error occurred while
evaluating/resolving the dependencies
of the export object.
Explanation: The server may be unable to connect to
the directory.
Administrator response: Verify that the server is able
to get a connection to the directory and to run a basic
lookup, then try adding the export object to the partial
export list again.
CTGIMK018E An error occurred while deleting the
export.
Explanation: The operation may have timed out or the
server may be unable to connect to the database.
Administrator response: Verify that the server is able
to get a connection to the database and to run a basic
database query, then deleting the export again.
CTGIMK019E
An export is already in progress.
Explanation: Export supports only single-thread
operations. An export process is already in progress.
Administrator response: Click the Refresh button to
view the most recent export processes. Wait until the
active export is complete before you submit the export
again.
CTGIMK020E Access definition exists for the
selected access type. Removal is not
allowed.
Explanation: Deletion of access type that has
dependent data is not allowed.
Administrator response: Please make sure that there
is no access definition under manage groups and
manage roles tasks that is using this access type.
CTGIMK021E Unable to create access_type_name
access type, duplicate access type key
exists.
Explanation: Access types with identical key are not
allowed by the system
User response: Please change the access type key and
try the operation again.
CTGIMK022E The role relationship cannot be
created during import. The
parent_role_name role is a descendent of
the child_role_name role.
Explanation: Cycles in the role hierarchy are not
allowed, but the proposed import file would have
created a cycle.
User response: Check the parent-child relationship for
the roles that are in the target system, and compare it
with the role relationship to be imported. Look for
cycles that might be created by combining the two sets
of role relationships.
CTGIMK023E
An import is already in progress.
Explanation: Import supports only single-thread
operations. An import process is already in progress.
Administrator response: Click the Refresh button to
view the most recent import processes. Wait until the
active import is complete before you submit the import
again.
CTGIMK024E Unable to create ownership_type_name
ownership type, duplicate ownership
type key exists.
Explanation: Ownership types with identical key are
not allowed by the system
User response: Please change the ownership type key
and try the operation again.
CTGIMK025E The access type cannot be deleted
because it is not empty.
Explanation: The access type cannot be deleted if it
contains one or more access type entities.
User response: Delete all the children access types,
then try the operation again.
CTGIMK026E The combined access type key length
for the access_type_name access type key
exceeds the maximum character limit.
The maximum number of characters for
the combined access type key is 700.
Messages
87
CTGIML001E • CTGIML009E
Explanation: The value specified in the access type
key field exceeds the maximum limit of 2048 characters.
This field must contain fewer characters than the
maximum or defined character limit.
User response: Please reduce the number of characters
in the access type key field to the number allowed as
defined and and try the operation again.
Web client messages
CTGIML001E
The reconciliation property file
cannot be edit. You must have the
proper authorization to edit this file.
Explanation: The operation cannot complete because
the user is not authorized to edit the reconciliation
properties for the service.
User response: Verify that you are authorized to edit
the reconciliation properties for this service.
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIML006E
An error occurred deleting one or
more reconciliation queries.
Explanation: An internal error occurred.
CTGIML002E
An error occurred while adding one
or more reconciliation units.
Explanation: An internal processing error occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIML003E
An error occurred while deleting one
or more reconciliation units.
Explanation: An internal error occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIML004E
An error occurred processing one or
more reconciliation units.
Explanation: An internal error occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIML007E
An error occurred modifying one or
more reconciliation queries.
Explanation: The Search Filter on the Add
Reconciliation Query page is incorrect. The field must
contain an LDAP filter which is used to define what
should and should not be included in the
reconciliation.
Administrator response: Change the Search Filter
field and try the operation again.
CTGIML008E
The style sheet cannot be found.
Explanation: The IBM Security Privileged Identity
Manager XSL style sheet cannot be found in the file
system.
Administrator response: Verify that the installation
program completed successfully and that all IBM
Security Privileged Identity Manager directories were
created. The style sheet is located in the xsl directory.
Validate the system folder structure integrity and that
the xsl folder exists with its files.
CTGIML009E
An error occurred during XSL
processing.
Explanation: An internal error occurred.
Explanation: The IBM Security Privileged Identity
Manager user interface transformation error occurred.
The IBM Security Privileged Identity Manager console
uses the style sheet to format the user interface pages.
The pages cannot be formatted correctly.
Administrator response: Review the IBM Security
Administrator response: An internal processing error
CTGIML005E
88
An error occurred adding one or more
reconciliation queries.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIML010E • CTGIML018E
occurred, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
The transformation error is probably a result of an
unescaped special character.
CTGIML010E
The URL cannot be accessed.
Explanation: The specified URL is not a valid address
in this system.
User response: Verify that the URL is specified
correctly and it is accessing the IBM Security Privileged
Identity Manager server.
CTGIML011E
The screen position in the sequence
cannot be determined.
Explanation: An internal processing error occurred
and the IBM Security Privileged Identity Manager
server could not determine the screen position.
Administrator response: Try the operation again. If
the problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
Determine the steps where the system lost track of the
screen sequence. Usually a work around is to repeat the
operation
CTGIML012E
No session has been established.
Explanation: There is no session that has been
established for the current user. Either the session has
expired or the user has not login.
User response: Log into the system again to establish
a valid session.
CTGIML013E
There is no session for the specified
user. Establish another session to
continue.
Explanation: A session cannot be found for the
specified user. Either the current user session has
expired or the user has not logged in.
User response: Log into the system to establish a
valid session and continue.
This exception occurred when there is no valid session
for the NameUtility to look up the name.
CTGIML014E
The DN provided is null.
Explanation: An internal processing error occurred.
The DN provided for the NameUtility to look up name
is NULL.
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
The DN selected is mishandled and become NULL.
CTGIML015E
The name cannot be found.
Explanation: An internal processing error occurred.
The NameUtility cannot find the matching name for the
provided key.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
An exception occurred during the look up of name by
NameUtility class. Check the IBM Security Privileged
Identity Manager log file (trace.log) for the specific
exception.
CTGIML016W
A cached data cannot be found.
Explanation: This is an internal processing error. An
error occurred trying to retrieve the cached data. The
NameUtility could not find the cached data.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIML017W The business unit or organization
container is not valid.
Explanation: The user does not have access to the
container for the selected operation.
Administrator response: Make sure access is granted
for the specific container.
CTGIML018E
An exception occurred while
performing an access check.
Explanation: An internal processing error occurred,
when system performed an access check.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
There is an exception that occurred during access
checking. Check the IBM Security Privileged Identity
Manager log file (trace.log) for the specific exception.
Administrator response: Check IBM Electronic
Support for additional information
Messages
89
CTGIML019W • CTGIMM007E
CTGIML019W An error occurred while processing
your request.
Explanation: An internal processing error occurred
locating or using the system EJB.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
An exception occurred during EJB lookup. Check the
IBM Security Privileged Identity Manager log file
(trace.log) for the specific exception.
CTGIML020E
The DN is missing.
Explanation: An internal processing error occurred
providing an incorrect value for the DN.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
information regarding the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
An exception occurred. Check the IBM Security
Privileged Identity Manager log file (trace.log) for the
specific exception.
CTGIML024W The user ID does not exist. A valid
user ID is needed to login.
Explanation: The system does not recognized the user
ID used to login.
User response: Ensure that the user ID being used is
typed in correctly.
Administrator response: Make sure user ID exist in
the system and the account is valid.
Check the IBM Security Privileged Identity Manager
log file (trace.log) for the specific exception.
CTGIML025E
The browser is not cookie enabled.
The browser must be enabled for
cookies for IBM Security Privileged
Identity Manager to work properly.
The DN for this operation is mishandled causing an
error. Check for the sequence and the screen where this
error occurred.
Explanation: IBM Security Privileged Identity
Manager requires that the browser being used is cookie
enable.
CTGIML021E
User response: Use the browser tools to enable
cookies.
The object category is missing.
Explanation: An internal error occurred processing the
category. The category is not provided to complete the
request.
Administrator response: Try the request again. If the
problem persists, review the IBM Security Privileged
Identity Manager log files for additional information
regarding the error. Check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
The code might have mishandled the category.
Determine which screen this data is lost.
CTGIML023E
An unknown error occurred.
Explanation: An unanticipated error has occurred.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
CTGIML026W There are no entries selected. Select
one or more entries.
Explanation: No entries were selected for the request.
User response: Select one or more entries for the
request.
CTGIML027W
The DN is not valid.
Explanation: The selected entries contain an incorrect
DN.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Authentication response messages
CTGIMM006E
The user ID cannot be found.
Explanation: The specified user ID does not exist. The
login process cannot continue without a valid user ID.
User response: Verify that the user ID is typed
90
correctly. Specify a valid user ID and password and
click Login.
CTGIMM007E The user ID is missing. Enter your
user ID to login.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMM008E • CTGIMM035E
Explanation: A valid user ID must be specified to
login.
CTGIMM027E
User response: Enter a valid user ID to login.
Explanation: The tenant is not in an active state. This
is only for a multi-tenant deployment.
CTGIMM008E The information used to login is not
correct.
CTGIMM009E The information used to login is not
correct.
Explanation: See message.
User response: Specify a valid user ID and password.
CTGIMM010E The value entered for the password
is incorrect. There are pw_attempts_left
attempts left for entering a correct
password.
Explanation: The value for the password is not
correct. The invalid logon attempts property defines the
number of times an incorrect password can be
specified. Once the number of attempts exceeds this
value the account will be suspended.
User response: Type in a valid password and submit
the password again.
Administrator response: Make sure to activate the
tenant.
CTGIMM028E
The directory server is not available.
Explanation: Communication with the directory server
could not be established.
Administrator response: Verify that the directory
server is available and there are no network outages.
CTGIMM029E
Unable to login with the user ID.
Explanation: Either the user id provided is not correct
or the system is unable to convert the Tivoli Access
Manager user id to IBM Security Privileged Identity
Manager user ID.
Administrator response: Make sure that the Tivoli
Access Manager user ID is the same as IBM Security
Identity Manager user ID or at least IBM Security
Privileged Identity Manager with a different user ID.
CTGIMM030E
CTGIMM011E The user ID is missing. Type a valid
user ID and password to login.
The tenant is not active.
The tenant cannot be found.
Explanation: The specified tenant ID is not valid.
Explanation: A valid user ID must be specified to
login.
Administrator response: Make sure that the tenant ID
specified in enRole.properties file is same as the one
configured in the directory server.
User response: Enter a valid user ID and password to
login.
CTGIMM033E
CTGIMM012E
Explanation: The specified factory class name to create
platform context is not found in the classpath.
A value for tenant is missing.
Explanation: A valid tenant id is must be specified to
login. This is only for a multi-tenant deployment.
User response: Make sure that the tenant id is
specified along with the logon URL.
CTGIMM013E The password is missing. Type a
valid password for the user ID
specified.
Explanation: A valid password must be specified to
login.
User response: Enter the password associated with the
user ID.
CTGIMM026E
The account is not active.
Explanation: The specified user account is suspended.
User response: Contact the system administrator to
activate the account.
The class definition cannot be found.
User response: Make sure that the factory class name
provided to create platform context is correct.
CTGIMM034E Your password is no longer valid.
Either the password has expired or you
are required to change the password.
Explanation: The specified password is no longer
valid. Either the password is expired or your system
administrator requires you to change the password.
User response: Change your password first.
CTGIMM035E Your account is suspended due to
maximum allowed invalid logon
attempts are reached.
Explanation: The account is currently suspended and
cannot be accessed.
User response: Contact the system administrator to
restore your account.
Messages
91
CTGIMM036E • CTGIMM057E
CTGIMM036E The response is incorrect. Enter
correct response.
Explanation: The responses provided for the
challenges are incorrect.
User response: Enter the correct responses and try
again.
CTGIMM037E The response is not correct. You have
invalid_attempts_left attempts left to enter
a valid response before your account is
suspended.
Explanation: The response to the challenge question is
not correct. A correct response must be provided within
the maximum number of attempts. If the maximum is
reached without a correct response, the account is
suspended.
User response: Enter the correct responses and try
again.
CTGIMM044E Your session has timed out. Enter
your user ID and password to
re-establish your session.
Explanation: The current session exceed the maximum
time limit for a session. When this occurs the session is
ended. To continue, you must establish another session
by logging in again.
User response: Enter the user ID and password on the
login page to establish the session again.
CTGIMM045E Your session has timed out. Enter
your user ID and password to establish
a new session.
Explanation: The current session exceed the maximum
time limit for a session. When this occurs the session is
ended. To continue, you must establish another session
by logging in again.
User response: Enter the user ID and password on the
login page to establish the session again.
CTGIMM046E There is no challenge response
defined for this user.
Explanation: There is no challenge response defined
for this user. You should have already defined your
challenge response to use this function.
User response: Login with your user ID and
password. Once authenticated, you must define a
challenge response.
CTGIMM049E The password challenge response
function is disabled. Contact the IBM
Security Privileged Identity Manager
administrator for more information.
Explanation: The system administrator has disabled
the password challenge response function.
User response: Contact system administrator to get
the new password if you forgot the old password.
CTGIMM050E The password challenges have
changed. Contact your system
administrator for assistance.
Explanation: The administrator has changed the
password challenges.
User response: Contact the system administrator.
CTGIMM052E Enable the challenge response
function to continue.
Explanation: To configure challenge questions, the
challenge response function must be enabled.
User response: Click the Enable challenge response
field to continue with defining challenge questions.
CTGIMM054E Select the challenge mode and click
the link to define at least one challenge
for each locale.
Explanation: At least one challenge must be defined
for each available locale for either PRE-DEFINED or
USER-SELECTED or RANDOM-SELECTED challenge
mode.
Administrator response: Enter at least one challenge
for each available locale.
CTGIMM055E The maximum number of challenges
for a pre-defined mode is 5. Click the
link to define within the limit for each
locale.
Explanation: The challenges defined for one or more
available locale in PRE-DEFINED challenge mode is
exceeding the maximum of 5.
Administrator response: Enter challenges for each
available locale for a PRE-DEFINED challenge mode to
be limited to a maximum of 5.
CTGIMM057E Each locale should have the same
number of challenges defined.
Explanation: The number of challenges that are
defined for each locale is not the same.
Administrator response: Enter the same number of
challenges for each locale.
92
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMM058E • CTGIMM070E
CTGIMM058E The value for the number of
challenges the user must respond is not
valid. Type an integer from one to five.
Explanation: When configuring the user-selected
mode the number of challenges a user must respond
must be an integer from 1 to 5.
Administrator response: Type a number of 1 to 5 in
the Number of challenges the user must respond to
field.
CTGIMM059E The value for the number of
challenges the user must define is not
valid. Type an integer from one to five.
Explanation: The value for the Number of challenges
user must define field is not valid. The value for this
field must be an integer one through five.
Administrator response: Change the value for the
Number of challenges user must define on the
Configure challenge/response page.
CTGIMM060E The value for the number of
challenges the user must respond is not
valid. Type a number between 1 and 10.
Explanation: When configuring the random-selected
mode the number of challenges a user must respond
must be an integer of 1 to 10.
Administrator response: Type a number of 1 to 10 in
the Number of challenges the user must respond to
gain system access field.
CTGIMM061E The value for the number of random
challenges is not valid. Type a number
between 1 and the value specified for
the number of challenges a user must
define.
Explanation: The number of random challenges must
be at least one and does not exceed the number
specified for the number of user-defined challenges.
Administrator response: Type a number that meets
the above criteria.
CTGIMM062E The random number of challenges
for a random-selected mode should
always be greater than 0 and less than
or equal to 5. Click the link to define
within the limit.
Explanation: The number of random challenges must
not exceed a maximum of 5.
Administrator response: Type a number that meets
the above criteria.
CTGIMM064E The number of random challenges is
greater than the number that is required
to be answered. Reduce the number of
random challenges.
Explanation: The random number of challenges
cannot be greater than the number of challenges the
user is required to respond.
Administrator response: Either reduce the value for
the Number of challenge(s)/response(s) user must
configure field or the Number of random challenge(s)
user must respond to gain system access field.
CTGIMM065E The challenges defined for each
locale cannot be less than the number of
challenges the user must respond to.
Explanation: The value for number of challenges the
user must respond to must always be less than the
number of challenges defined for each locale.
Administrator response: Reduce the number of
challenges.
CTGIMM067E The maximum number of challenge
questions that can be defined is 100 for
each locale.
Explanation: More than 100 challenge questions has
been defined for one or more locales. This exceeds the
maximum limit of 100 questions.
Administrator response: Remove the unnecessary
questions to reduce the number of questions to 100 or
below for each locale.
CTGIMM068E Type the Challenge question in the
Challenge field.
Explanation: The Challenge field is empty.
Administrator response: To define a challenge
question, type the question in the Challenge text field.
CTGIMM069E Select a challenge question from the
list to modify the challenge.
Explanation: A challenge question must be
highlighted to change it.
Administrator response: From the list of challenges,
click the challenge question to be modified.
CTGIMM070E To modify a challenge, select one
challenge question from the list.
Explanation: Only one challenge question can be
highlighted to change it.
Administrator response: From the list of challenges,
click only one challenge question to be modified.
Messages
93
CTGIMM071E • CTGIMM082E
CTGIMM071E Select one or more challenge
questions from the challenges list to
delete.
CTGIMM077E Number of challenges the user must
respond to for user-selected mode must
be an integer between 1 and 5.
Explanation: A challenge question must be
highlighted to delete it. Multiple challenge questions
can be deleted at one time.
Explanation: The value entered for the number of
challenge is not valid. The value must be an integer
from 0 to 5.
Administrator response: Select the challenge questions
to be deleted and click delete.
Administrator response: Enter an integer of 0 to 5 for
the Number of challenge field.
CTGIMM072E The value for the number of
challenges a user must respond must be
an integer greater than zero.
CTGIMM078E The number of challenges the user
must respond to for random-selected
mode must be an integer from 1 to 10.
Explanation: The value specified for the number of
challenges a user must respond is not valid. The value
for this field must be an integer value of one or greater.
The value should not exceed the number of defined
challenge questions.
Explanation: The value specified for the Number of
challenge(s)/response(s) user must configure field is
incorrect.
Administrator response: Specify an integer value of
one and above for the Number of challenges a user
must respond to gain system access field.
CTGIMM073E The number of challenges a user
must respond to cannot be empty.
Explanation: The value for the number of challenges a
user must respond is missing. This field is required to
continue.
Administrator response: Specify a value for the
number of challenges.
CTGIMM074E Only positive integer values are
allowed for random number of
challenges.
Explanation: The value specified for the random
number of challenges is not valid.
Administrator response: Enter a positive integer
value.
CTGIMM075E The value for the random number of
challenges is missing.
Explanation: A value is required for the random
number of challenges.
Administrator response: Specify a value for the
random number of challenges.
CTGIMM076E At least one challenge must be
configured for the locale
Explanation: Each locale is required to have at least
one challenge question defined.
Administrator response: Specify a valid value.
CTGIMM079E The total number of challenges for
pre-defined mode cannot be greater than
5.
Explanation: The maximum number of challenges for
a PRE-DEFINED challenge mode is limited to 5.
Administrator response: Enter challenges within a
limit of 5.
CTGIMM080E The number of random challenges
must be an integer between 0 and 5.
Explanation: The value for the Number of random
challenge(s) user must respond to gain system access is
not valid.
Administrator response: Specify an integer greater
than 0 and less than 5.
CTGIMM081E The challenge question exceeds the
maximum length of 234 characters.
Explanation: A challenge question cannot exceed a
length of 234 characters.
Administrator response: Reduce the number of
characters in the Challenge field.
CTGIMM082E The format for the e-mail address is
not valid.
Explanation: An e-mail address must be in the format:
user_id@server_name.type.
Administrator response: Verify that the email is
correct. Type the correct email and try the operation
again.
Administrator response: Specify a challenge question
for the each locale in the Challenge field.
94
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMM083E • CTGIMM097E
CTGIMM083E One or more responses cannot be
empty.
CTGIMM091E Unsuccessful login to WebSphere
application server.
Explanation: The responses cannot be empty for one
or more challenges.
Explanation: Unable to login to application server
with the given credentials.
User response: Enter responses for all the challenges
provided.
User response: Make sure that the ejb user, ejb
credential, url to the application server are correct.
CTGIMM085E
CTGIMM092E Unsuccessful login to WebLogic
application server.
One or more responses do not match.
Explanation: One or more responses provided do not
match the confirmation response.
User response: Verify that the correct response as well
as confirmation are specified for each challenge
question. Make the necessary corrections and try again.
CTGIMM087E Select the required number of
challenges from available list to user list
and continue.
Explanation: The exact required number of challenges
must be selected from the administrator-defined list to
the user list.
User response: Select the required number of
challenges from the available list to the user list.
CTGIMM088E Add the required number of
challenges to the list and continue.
Explanation: Unable to login to application server
with the given credentials.
User response: Make sure that the ejb user, ejb
credential, url to the application server are correct.
CTGIMM093E
The challenge is empty.
Explanation: The challenge needs to exist.
User response: Make sure that the challenge exists.
CTGIMM094E One or more responses cannot be
empty.
Explanation: The responses cannot be empty for one
or more challenges.
User response: Enter responses for all the challenges
provided.
Explanation: The challenges are missing.
User response: Add the appropriate number of
challenges.
CTGIMM089E Duplicate challenges not allowed.
Enter another challenge question to add.
Explanation: The same challenge question cannot be
added.
User response: Enter another challenge question to
continue.
CTGIMM090E Either this is the first time you
logged on, or your system administrator
has changed password challenge
question. Provide responses to the
challenges.
Explanation: This is the first time that the user has
logged on to the system after system administrator has
setup initial password challenges or the system
administrator has modified the challenge response
configuration.
User response: Provide a response accordingly to the
configuration set by the system administrator.
CTGIMM095E The required number of challenges
must be configured by the user.
Explanation: The user must configure the required
number of challenges set by the administrator.
User response: Configure the required number of
challenges and responses.
CTGIMM096E There are no administrator-defined
challenges.
Explanation: There is no administrator-defined
challenges for the user's locale.
Administrator response: Make sure to define
challenges for the user's locale.
CTGIMM097E There is no change made by the user
to update the challenge/response.
Explanation: User did not make any changes to his
challenge/response.
User response: Make changes to the
challenge/response to update.
Messages
95
CTGIMM098E • CTGIMN005E
CTGIMM098E One or more challenges do not
belong to the administrator-defined
challenges.
Explanation: The user challenges should be picked
from a set of administrator-defined challenges.
User response: Make sure that challenges are picked
from the administrator-defined list.
CTGIMM099E
The user ID cannot be found.
CTGIMM102E
The directory server is not available.
Explanation: The directory server is either stopped or
not running.
Administrator response: Ensure that the directory
server is running.
CTGIMM103E The WebSphere application security
is not enabled.
Explanation: The WebSphere application security
should be enabled.
User response: Contact the system administrator to
enable WebSphere application security.
CTGIMM104E The WebSphere account repository is
not set.
Explanation: The WebSphere account repository
attribute under ITIM Service points to the managed
service that contains the account login information. In
order for the password to be changed or reset this
attribute must be set.
User response: Navigate to the manage services tab
for ITIM Service and set the WebSphere account
repository. 1. Log in to IBM Security Privileged Identity
Manager and click on Manage Services. 2. Type 'ITIM
Service' in the search information and select Search by
service. 3. Click Search. 4. Select ITIM Service. 5. Under
WebSphere account repository click Search. 6. Enter in
the search criteria or leave it blank if you do not know
the name of the service. 7. Select a service from the
search results and click OK. The service name is
displayed under WebSphere account repository. 8. Click
OK to save the changes. 9. The WebSphere account
repository is now set and the error no longer occurs. If
you do not have the authority or are unable to set the
WebSphere account repository, contact the system
administrator.
Administrator response:
Administrator response: Enable WebSphere
application security for IBM Security Privileged
Identity Manager.
Reporting messages
CTGIMN001E The Incremental Data Synchronizer
processing could not locate the
changelog needed to perform data
synchronization.
Explanation: The changelog directory cannot be
found. The Incremental Data synchronizer uses entries
stored under the cn=changelog directory for
synchronizing data. The change log feature must be
available before starting incremental data
synchronization.
Administrator response: Run a full data
synchronization and then run the Incremental Data
Synchronizer.
CTGIMN002E
The report template cannot be found.
Explanation: An exception occurred while retrieving
the report template.
Administrator response: Review the log files for
additional information regarding the error.
CTGIMN003E An error occurred while saving a
report template using the Crystal
Reports designer.
96
Explanation: The report template could not be saved.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN004E An error occurred while updating a
report template that was created using
the Crystal Reports designer.
Explanation: The report template could not be
updated.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN005E An error occurred while retrieving a
custom report template.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMN006E • CTGIMN014E
Explanation: The report template cannot not be
retrieved.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN006E The column_name column in the
report is not available for reporting.
Explanation: The specified column is not being used.
The column cannot be specified in the report template.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN007E
The report query is not valid.
Explanation: Required values for the report query are
not set properly.
Administrator response: Check if the report columns,
report tables and report filters are being set properly.
CTGIMN008E The DataBaseFunctions.conf file is
missing.
Explanation: The DataBaseFunctions.conf file contains
user-defined database functions used in designing
report templates. This file cannot be found.
Administrator response: Verify that the
DataBaseFunctions.conf configuration file exists and is
in the proper format.
CTGIMN009E An error occurred while parsing the
report template files.
Explanation: A ZQL parser exception occurred while
parsing the report template file. A coding error was
detected in the files.
Administrator response: Review the log files for
additional information regarding the error. Check the
report template files for any syntax error.
CTGIMN010E An error occurred while saving a
custom report template.
Explanation: The custom report template cannot be
saved.
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN011E An error occurred while updating a
custom report template.
Explanation: The custom report template cannot be
updated.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN012E The data for a specified column in
the report template is no longer
available. Remove the column from the
report template.
Explanation: A column defined in the report template
is no longer valid. The data contained in the column is
not available.
Administrator response: Modify the report template
to remove the column and save the report again.
CTGIMN013W An error occurred while closing the
resource.
Explanation: The resource could not be closed.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN014E An error occurred while creating the
report into PDF format.
Explanation: The format of the report is PDF as
defined by the Select Report Format field as one of the
report criteria. An error occurred creating the PDF of
the report data.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
Messages
97
CTGIMN015E • CTGIMN023E
CTGIMN015E The generated report exceeds the
maximum record count. The report is
not generated.
Explanation: The maximum number of records
allowed in a report is configured in the
enRole.properties system configuration file. The report
being generated exceeds the maximum record count
specified in the configuration file.
Administrator response: Change the value in the
enRole.properties file to allow more records in the
reports. Or, add more filter conditions to reduce the
size of the report by making the data gathered more
restricted.
CTGIMN016E The column cannot be unmapped
because the data is being used in a
report.
Explanation: The mapped attributes cannot be
removed so that it is no longer available for reporting.
Only attributes not used in any reports can be
unmapped.
Administrator response: Delete all the reports using
the attribute and try to unmap the column again.
CTGIMN017W One of the tables to be listed in the
report is not available for use in the
report. The table has been moved from
available to not available after the
report was designed.
Explanation: The report contains a table that is
currently listed as not available for reports. This table
was listed as available in the report designer when the
report was initially designed but has since been
removed. The table data will be displayed.
Administrator response: Change the report definition
to remove the table.
CTGIMN018E The reporttabledeny.properties file is
missing. The file contains the list of
tables that are not listed in the report
designer.
Explanation: The reporttabledeny.properties property
file is missing. The file is added during installation and
has been removed.
Administrator response: Check the product directory
for the file. Review the IBM Security Privileged Identity
Manager log files for additional information. If the
problem persists, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
98
CTGIMN019E An error occurred while parsing
attributes of entity.
Explanation: The incremental synchronizer
encountered an error while analyzing the changes for
an entity's attributes.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMN020E An error occurred while processing
an LDAP operation.
Explanation: An error occurred accessing the directory
server or an LDAP search failed.
Administrator response: Verify that the directory
server is active. Review the IBM Security Privileged
Identity Manager log files for additional information
regarding the error.
CTGIMN021E One or more input parameters are
not valid.
Explanation: At least one of the parameters specified
on the incremental data synchronization command is
not correct. The command syntax is
startIncrementalSynchronizerCMD_WAS[.bat|.sh]
userID passwd changelog_base_dn time_interval
[runInBackground]. The time_interval value must be
specified in seconds.
Administrator response: Verify that all the required
parameters are specified correctly and try the command
again.
CTGIMN022E The value for the time interval is not
valid.
Explanation: The value specified on the incremental
data synchronization command for the time interval
parameter is not correct.
Administrator response: Enter a valid time interval
and try the command again.
CTGIMN023E The operation specified for the entity
is not valid.
Explanation: The incremental synchronizer has
detected that an operation performed for an entity
(such as, Person and Account) and its attributes is not
valid.
Administrator response: Check the attributes
associated with the entity to verify they are correct.
Make the appropriate changes and try the operation
again.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMN024E • CTGIMN031E
CTGIMN024E The field in the Crystal Report
template is not valid.
Explanation: An error exists with the Crystal Report
template created by the report designer. The Crystal
Report template needs to be updated to remove the
error.
Administrator response: Import the report template
file and try the operation again.
CTGIMN025E One or more Crystal Report
templates contain an error. Report
contains an unsupported field or field
type used in the report.
Explanation: There is a problem with one or more
Crystal report templates. The reason could be that field
contains some unsupported data type.
Schema designer UI. However if there are any object
filters using the single valued attributes of this entity,
then they will be mapped implicitly. If the data
synchronization fails due to this error, please unmap a
few single valued attributes for this entity in schema
designer or delete the object filters and run data
synchronization again.
CTGIMN029E An I/O error has occurred while
importing a file.
Explanation: Probably file size exceeds the maximum
limit for POST requests.
Administrator response: Check whether the right file
is being imported.
Administrator response: Refer to log files to
determine the type of unsupported field being used.
CTGIMN030E One or more Crystal Report
templates contain an error. Report
contains nonsupported table used in the
report.
CTGIMN026E The report template created using the
Crystal Report designer cannot be
accessed.
Explanation: There is a problem with one or more
Crystal report templates. The reason could be that
report-related system tables are being used in the
report.
Explanation: The report template cannot be accessed
from the Crystal Report application server.
Administrator response: Check the status of the
Crystal Report application server. It should be running.
CTGIMN027E An error occurred during data
synchronization
Explanation: The data synchronization process could
not complete because of an error detected during
processing.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information regarding the error. Correct the problem,
and try the operation again if necessary. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
Administrator response: Refer to log files to
determine the type of unsupported entity name being
used. Check whether the system tables used are
included in the report template. Remove the tables, if
used in the report template
CTGIMN031E The following error occured while
communicating with crystal
server.Error:{0}
Explanation: An error occurred while communicating
with server. Possible reason could be 1) Crystal server
down. 2) Problem in establishing connection with
crystal server.
Administrator response: An error occurred while
communicating with server. Possible reason could be 1)
Crystal server down. 2) Problem in establishing
connection with crystal server. Check the connectivity
with crystal server if it is up.
CTGIMN028E Cannot map more than {0} single
valued attributes for the entity {1}
because of DB2 row size limitation. If
the data synchronization fails, please
unmap a few single valued attributes
for this entity. Please note that certain
attributes may be implicitly mapped
because of object filters in ACIs.
Explanation: Data synchronization fails for DB2
database if more than 123 single valued attributes are
mapped for an entity in schema designer.
Administrator response: The user cannot map more
than 123 single valued attributes for an entity on the
Messages
99
CTGIMO001E • CTGIMO012E
Common messages
CTGIMO001E An EJB error occurred. The
transaction will roll back.
Explanation: An error occurred processing the
transaction.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO002E An unhandled error occurred. The
following error occurred. Error: error_text
Explanation: An earlier error occurred that was not
reported or processed. An attempt to recover from the
error and continue with processing was unsuccessful.
Administrator response: Check for system errors.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMO003E
The file_name file cannot be found.
Explanation: See message.
Administrator response: Check that the file exists.
Create the file if necessary. If the file is an IBM Security
Privileged Identity Manager file, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO004E The following JMS error occurred.
Error: error_text
Explanation: An earlier error occurred that was not
reported or processed. An attempt to recover from the
error and continue with processing was unsuccessful.
Administrator response: Check for system errors.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMO005E The following I/O error occurred.
Error: error_text
Explanation: An earlier error occurred that was not
reported or processed. An attempt to recover from the
error and continue with processing was unsuccessful.
Administrator response: Check for system errors.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMO006E The following SQL error occurred.
Error: error_text SQL State: sql_state
Explanation: See message.
Administrator response: Check for database errors.
Review the IBM Security Privileged Identity Manager
100
and database log files for additional information about
the error.
CTGIMO007E An error occurred while parsing the
entity_name entity located at line
line_number and column column_number.
Explanation: The syntax for the entity contains an
error.
Administrator response: Check the entity for syntax
errors.
An SAX parsing error occurred
CTGIMO008E The following SAX error occurred.
Error: error_text
Explanation: An earlier error occurred that was not
reported or processed. An attempt to recover from the
error and continue with processing was unsuccessful.
Administrator response: Check for system errors.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMO009E An InvocationTargetException error
occurred. The following error occurred.
Error: error_text
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO010E An unexpected error occurred
preventing future transaction services
from proceeding. The following error
occurred. Error: error_text
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO011E An error occurred while creating the
EJB component. The following error
occurred. Error: error_text
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO012E The EJB component cannot be found.
The following error occurred. Error:
error_text.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMO013E • CTGIMO023E
Explanation: The EJB component cannot be located.
files for additional information about the error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO018E The following directory server error
occurred. Error: error_text
Explanation: The JNDI service is not available.
CTGIMO013E An error occurred while deleting the
EJB component. The following error
occurred. Error: error_text.
Explanation: The EJB component could not be
removed.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO014E Communication Failure. The
directory server is not available. Error:
error_text
Explanation: A communication error occurred when
the system attempted to access the directory server.
This may be the result of the directory server is not
available or overloaded with requests.
Administrator response: Verify that the directory
server is available and that there are no network
outages, and then try the operation again. Review the
IBM Security Privileged Identity Manager log files for
additional information about the error. If the problem
persists, check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMO015E An error occurred retrieving
information from the directory server.
The following JNDI configuration error
occurred. Error: error_text
Explanation: See message.
Administrator response: Check that the LDAP
directory server is available. Review the directory
server log files for additional information about the
error.
CTGIMO016E The JNDI limit has been exceeded.
The following error occurred. Error:
error_text
Explanation:
Administrator response:
CTGIMO017E The following directory server
schema violation occurred. Error:
error_text
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional information about the error.
CTGIMO019E The following LDAP error occurred.
Error: error_text
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
files for additional information about the error.
CTGIMO020E The transaction is rolled back. Detail:
detail_info
Explanation:
Administrator response:
CTGIMO021E The following unhandled error
occurred. Error: error_text
Explanation: An earlier error occurred that was not
reported or processed. An attempt to recover from the
error and continue with processing was unsuccessful.
Administrator response: Check for system errors.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMO022E The following unhandled error
occurred. Error: error_text
Explanation: An earlier error occurred that was not
reported or processed. An attempt to recover from the
error and continue with processing was unsuccessful.
Administrator response: Check for system errors.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMO023E The following definition error
occurred. Error: error_text
Explanation: See message.
Administrator response: Review the error text for
details. Make the necessary corrections and try the
operation again.
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager and directory server log
Messages
101
CTGIMO024E • CTGIMO035E
CTGIMO024E The method or parameter is not
supported.
CTGIMO030E An error occurred while retrieving
the encryption configuration properties.
Explanation: The method or parameter is not
recognized. A parameter object may be null. A field of a
parameter object may contain null or a non-supported
value.
Explanation: The encryption configuration properties
could not be access.
Administrator response: Check that the syntax is
correct and the name is spelled correctly. Remove the
non-supported method or parameter. In case, a
parameter object or a field of a parameter object
contains non-supported value or null, use valid values
instead.
CTGIMO025E Unable to communicate with the
operating system.
Explanation: A session with the operating system
cannot be established.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO031E The cipher_suite encryption cipher is
not valid for the installed encryption
providers.
Explanation: The encryption cipher does not match
what the encryption provider expects.
Administrator response: Check that the correct
encryption cipher is being used. Make the necessary
adjustments.
CTGIMO026E A connection with the session bean
cannot be established.
CTGIMO032E A JCE error occurred while
initializing the encryption module.
Error: error_text
Explanation: An internal error occurred while
establishing a session with the session bean.
Explanation: An internal error occurred initializing the
encryption module.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO027E There is no provisioning object
implementation loaded.
CTGIMO033E The encryption manager is not
initialized.
Explanation: An internal error occurred while loading
the provisioning object.
Explanation: The encryption program is not started.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO028E The JNDI bind object cannot be
found. Error: error_text
Explanation: An internal error occurred locating the
bind object.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
102
Administrator response: Check that the encryption
program is started. Review the IBM Security Privileged
Identity Manager log files for additional information.
CTGIMO034E The UTF8 character set is not
supported.
Explanation: An UnsupportedEncodingException
error occurred using the UTF8 character set.
Administrator response: Check that the proper
character set is being used.
CTGIMO035E The JCE does not support the
specified hash algorithm. Encryption
cipher: cipher_suite
Explanation: An internal error occurred processing a
JCE request for the encryption cipher.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMO036E • CTGIMO045E
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO036E An error occurred while processing
an encryption request. The following
error occurred. Error: error_text
Explanation: An internal error occurred processing an
encryption or decryption request.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Explanation: The audit configuration or database is
not correct.
Administrator response: Start the trace log for
auditing exceptions. Review the log file for details.
CTGIMO040W The WebSphere global security is
disabled.
Explanation: WebSphere global security option is off
which allows the deployed EJB to be accessed by
anyone.
Administrator response: To secure your applications,
enable the security option.
CTGIMO041E An error occurred while auditing the
following event. Event: event_action
Event category: event_category
Explanation: The audit configuration or database is
not correct.
CTGIMO037E An unexpected exception while
processing an encryption request. The
following error occurred. Error:
exception_text
Administrator response: Start the trace log for
auditing exceptions. Review the log file for details.
Explanation: An internal error occurred processing an
encryption or decryption request.
CTGIMO042E An error occurred while creating the
cipher keystore. Error: error_text
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
Explanation: Either the cipher key could not be
generated or the key could not be written to file.
CTGIMO038E The buffer size error: Encrypted data
size: data_size Buffer size value:
buffer_size.
Explanation: The size of the buffer for encryption data
is not correct. The buffer is too small for the amount of
data.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO043E The specified keystore file already
exists: keystore
Explanation: The keystore file already exists and will
not be overwritten.
Administrator response: Increase the size of the buffer
for encryption data.
Administrator response: Specify a keystore file that
does not exist.
CTGIMO039E
CTGIMO044E
A database connection error occurred.
Explanation: The JDBC error occurred. A connection
with the database is stopped or cannot be established.
Administrator response: Review the IBM Security
Privileged Identity Manager and database log files for
additional information about the error.
CTGIMO040E An error occurred while auditing the
following event. Event: event_action
Event category: event_category Entity:
entity_name entity.
The class_name class cannot be found.
Explanation: See message.
Administrator response: Check that the class name is
correct and that class exists in the java class path.
CTGIMO045E The class_name class cannot be
instantiated.
Explanation: The specified class is either an interface
or an abstract class.
Administrator response: Check that the class name is
correct and the class is neither an interface, nor an
abstract class.
Messages
103
CTGIMO046E • CTGIMO112E
CTGIMO046E The definition of the name cannot be
accessed.
Explanation: The currently executing method does not
have access to the definition of the specified class, field,
method or constructor.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMO101E
The JavaScript object is not valid.
Explanation: The JavaScript environment object is
either empty or incorrect.
Administrator response: Check that the JavaScript
exists and is coded correctly.
CTGIMO102E The Scope field value is not correct.
The value must be an integer.
Explanation: The value for the Scope field is not an
integer.
Administrator response: Ensure that an integer value
is specified for the Scope.
CTGIMO103E The value for the Scope field must
be 1 or 2.
Explanation: See message.
Administrator response: Ensure that the value
specified for the Scope field is either 1 or 2.
CTGIMO104E An error occurred while either
encrypting or decrypting data.
Explanation: An error occurred while attempt to
either decrypt or encrypt data.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMO105E
The data object is empty.
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMO106E The profile name is empty. The
svcProfileContext property must be set.
Explanation: The service profile name is not found.
Administrator response: Specify a value for the
svcProfileContext property.
104
CTGIMO107E
The search context is not valid.
Explanation: The search logical context must be an
organizational container.
Administrator response: Change the search context
and try again.
CTGIMO108E An error occurred while creating a
JavaScript object. The object is not
created.
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMO109E An error occurred while converting
script object to a Java object.
Explanation: See message.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information.
CTGIMO110E The method is not supported by the
class_name class.
Explanation: This is an internal error. The class
attempted to use a method that is not supported.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information. Check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO111E Fail to add or update schema for
attribute [attribute_name]. Reason: details.
Explanation: Fail to add or update attribute definition
of LDAP schema. Review LDAP log for more detail.
Administrator response: Review the IBM Security
Privileged Identity Manager and LDAP log files for
additional information. Check IBM Electronic Support
for additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO112E Fail to update schema for object
class[class_name]. Reason: details.
Explanation: Fail to add or update class definition of
LDAP schema. Review LDAP log for more detail.
Administrator response: Review the IBM Security
Privileged Identity Manager and LDAP log files for
additional information. Check IBM Electronic Support
for additional information -www.ibm.com/software/
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMO202W • CTGIMO234E
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMO202W WARNING! This utility will change
the cipher key used for encryption, and
migrate the encrypted data in the
property files and in the LDAP server to
the new key. Please ensure the
following conditions have been met
before running this utility: - It is
strongly recommended that you backup
the contents of your LDAP server, so
that you can recover if a serious error
occurs while running the utility. - The
utility requires a fair amount of free
disk space. Please ensure you have
plenty of disk space before continuing
(about 1 megabyte per 1000 LDAP
users). - The Identity Manager
application should be stopped on all
servers and cluster members, but the
servers should continue running, to
ensure that the keystore file is
distributed to managed nodes. Failing to
stop the application may result in
corruption of encrypted data, if the
Identity Manager application
concurrently updates the LDAP server
while the utility is running. - There
should be no pending transactions in
the pending queue that involve
encrypted data, such as a change
password request.
CTGIMO203W WARNING! This utility will change
the cipher key used for encryption, and
migrate the encrypted data in the
property files to the new key. This
utility must first be run on the Network
Deployment Manager, where a keystore
file will be created. That keystore file
must then be distributed to this node
over the network, before running the
utility on this node. To distribute the
keystore file to this node, synchronize
the file system on this node with the
Network Deployment Manager using
the Websphere administrative console.
CTGIMO204W WARNING! This will resume
execution of the utility used to change
cipher keys. The utility will be restarted
from where it was before the error
occurred.
CTGIMO213W WARNING! A previous invocation
of this utility did not complete
successfully. It is strongly recommended
that you abort and restart the utility
with the 'resume' flag.
CTGIMO230E An error occurred while initializing
the utility. Error: error_text
Explanation: The cipher migration utility could not be
started because of an unexpected error.
User response: Review the exception details and the
trace log for additional information about the error.
CTGIMO231E There is no prior state from which to
resume the utility.
Explanation: The cipher migration utility cannot be
resumed unless it failed during a previous invocation.
User response: Please check the command line syntax
for the utility.
CTGIMO232E An error occurred while saving the
state of the cipher utility. Error: error_text
Explanation: The cipher migration utility saves its
state to a file so that it can resume after an error occurs.
An error prevented the utility from saving its state to a
file.
User response: Check the file system to ensure that
the utility has the permission, and disk space to create
files in {ITIM_HOME}\temp directory.
CTGIMO233E An error occurred while performing a
file system operation Error: error_text
Explanation: The cipher migration utility could not
read or write from the file system.
User response: Check the file system to ensure that
the utility has the necessary permissions and sufficient
disk space to read or write from it. Check the trace log
located in {ITIM_HOME}\temp for more details.
CTGIMO234E The new keystore file has not been
distributed to this node. Please
synchronize this node with the Network
Deployment Manager using the
Websphere Adminstrative Console.
Explanation: After the cipher migration utility creates
the keystore file at the Network Deployment Manager,
it copies it into the Websphere config directory, so that
it can be distributed to the managed nodes. This error
indicates that Websphere has not distributed the
keystore file to this managed node.
User response: Ensure the server is running on the
managed node so that it can receive updates from the
Messages
105
CTGIMO235E • CTGIMO242E
Network Deployment Manager. If necessary,
synchronize this managed node with the Network
Deployment Manager using the Websphere
administrative console.
CTGIMO235E The specified keystore password
does not match the password used to
create the keystore at the Network
Deployment Manager.
Explanation: The keystore password specified at the
managed node does not match the password used at
the Network Deployment Manager.
User response: Ensure that the password specified at
the managed node matches the password used to create
the keystore at the Network Deployment Manager.
CTGIMO236E An error occurred while
communicating with the LDAP server
Error: error_text
Explanation: The cipher migration utility encountered
an error while communicating with the LDAP server.
User response: Check the LDAP server to ensure that
it is running. Check the trace log located in
{ITIM_HOME}\temp for more details.
CTGIMO237E A parsing error occurred while
reading the temporary LDAP file Line:
line_text
Explanation: The cipher migration utility could not
parse the temporary LDAP file, either because it's
corrupted or contains invalid characters.
User response: Check the trace log located in
{ITIM_HOME}\temp for more details.
CTGIMO238E The cipher migration utility failed to
decrypt a property with the current
cipher settings. The property may have
been previously encrypted with
different cipher settings. To ignore these
errors, run the utility with the
'-skiperrors' flag. Location: location_text
Property: property_text
Explanation: A property could not be decrypted with
the current cipher settings. As a result, it cannot be
migrated to the new cipher settings. This may have
happened because the property's value got corrupted
or the property was previously encrypted with different
cipher settings.
errors. Check the trace log located in
{ITIM_HOME}\temp for more details.
CTGIMO239E An error occurred while updating the
property files Error: error_text
Explanation: The cipher migration utility could not
update the property files.
User response: Check the file system to ensure that
the utility has the necessary permissions and sufficient
disk space to read or write from it. Check the trace log
located in {ITIM_HOME}\temp for more details.
CTGIMO240E The cipher migration utility failed to
decrypt the LDAP password, needed to
connect to the LDAP server. The
password may either be corrupt or
incorrectly flagged as encrypted.
Explanation: The LDAP password could not be
decrypted with the current cipher settings. This
password is needed to successfully connect to the
LDAP server.
User response: Ensure that the
'enrole.password.ldap.encrypted' flag in
enRole.properties matches the state of the LDAP
password. If necessary, set this flag to false and re-enter
the LDAP password in clear text. Check the trace log
located in {ITIM_HOME}\temp for more details.
CTGIMO241E An error occurred while
synchronizing the file system on the
managed nodes. Please perform this
task manually using the Websphere
administrative console.
Explanation: The keystore file could not be distributed
to the managed nodes, because the synchronization
request failed to complete successfully.
User response: Check the trace log located in
{ITIM_HOME}\temp for more details. Manually
perform this task using the Websphere administrative
console.
CTGIMO242E The following credential vault error
occurred. Error: error_text
Explanation: See message.
Administrator response: Review the error text for
details. Make the necessary corrections and try the
operation again.
User response: If the property is contained in a
property file, ensure that the respective '*.encrypted'
flag in enRole.properties matches the state of the
property. If the property is contained in LDAP, ensure
that the values of 'password.attributes' in
enRole.properties references only encrypted attributes.
Run the utility with the '-skiperrors' flag to ignore these
106
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMQ002W • CTGIMQ038W
Installation and configuration messages
CTGIMQ002W The installation of product_name
completed. However, warnings were
encountered.
itim_install_activity.log and take action to correct the
problem. See the Installation and Configuration Guide
and Problem Determination Guide for more
information.
Explanation: The itim_install_activity.log file shows at
least one warning for the installation of IBM Security
Privileged Identity Manager. It is likely that IBM
Security Privileged Identity Manager will function
normally.
CTGIMQ008E The previous action resulted in a
FATAL ERROR.
User response: Review the itim_install_activity.log file
and address the cause of the warnings.
CTGIMQ003E The installation of product_name
completed. However at least one
nonfatal error was encountered.
Explanation: The itim_install_activity.log file shows at
least one nonfatal error for the installation of IBM
Security Privileged Identity Manager. It is likely that
IBM Security Privileged Identity Manager installed
successfully, but is not configured for use.
User response: You must address the cause of the
nonfatal errors before IBM Security Privileged Identity
Manager can be used. In most cases this indicates
problems with the middleware. See the other logs in
the ITIM_HOME/install_logs directory and the
Problem Determination Guide for assistance.
CTGIMQ004E The installation of product_name has
failed!
Explanation: The itim_install_activity.log file shows at
least one fatal error. The installation of IBM Security
Privileged Identity Manager has failed.
User response: You must address the cause of the
fatal errors before IBM Security Privileged Identity
Manager can be used. See the other logs in the
ITIM_HOME/install_logs directory and the Problem
Determination Guide for assistance.
Explanation: The previous action in the
itim_install_activity.log file resulted in a fatal error.
User response: Review the previous action in the
itim_install_activity.log and take action to correct the
problem. See the Installation and Configuration Guide
and Problem Determination Guide for more
information.
CTGIMQ030W product_name is already deployed on
the WebSphere Application Server.
Explanation: A deployed EAR file for IBM Security
Privileged Identity Manager was found on the
WebSphere Application Server. If this install was not an
upgrade, then the installation may fail.
User response: See the Installation and Configuration
Guide and Problem Determination Guide for more
information.
CTGIMQ035E The product_name EAR file failed to
deploy to the WebSphere Application
Server.
Explanation: The setupEnrole utility failed to deploy
the EAR file to the WebSphere Application Server.
User response: See the other logs in the
ITIM_HOME/install_logs directory and the Problem
Determination Guide for assistance.
CTGIMQ037E Target operating system is
supported..
CTGIMQ006W The previous action resulted in a
WARNING.
Explanation: Installed operating system is not
supported.
Explanation: The previous action in the
itim_install_activity.log resulted in a warning.
User response: Install IBM Security Privileged Identity
Manager on a supported operating system. See the
Installation and Configuration Guide for details.
User response: Review the previous action in the
itim_install_activity.log and correct the problem. See the
Installation and Configuration Guide and Problem
Determination Guide for more information.
CTGIMQ007E The previous action resulted in a
NONFATAL ERROR.
Explanation: The previous action in the
itim_install_activity.log file resulted in a nonfatal error.
CTGIMQ038W Level of the target operating system
is supported..
Explanation: Installed operating system is not at
supported level.
User response: Install IBM Security Privileged Identity
Manager on supported level of operating system. See
the Installation and Configuration Guide for details.
User response: Review the previous action in the
Messages
107
CTGIMQ039E • CTGIMR011E
CTGIMQ039E WebSphere Application Server is not
at the supported level.
CTGIMQ040E WebSphere Application Server is not
at the required fix level.
Explanation: The installed version of WebSphere
Application Server is not supported.
Explanation: The installed fix pack level for
WebSphere Application Server is not supported
User response: WebSphere Application Server 7.0 with
Fix pack 19 is required. Install IBM Security Privileged
Identity Manager on supported WebSphere Application
Server. See the Installation and Configuration Guide for
details.
User response: WebSphere Application Server 7.0 with
Fix pack 19 is required. Install IBM Security Privileged
Identity Manager on WebSphere Application Server
with supported fix pack level. See the Installation and
Configuration Guide for details.
Role management messages
CTGIMR001E An error occurred while creating a
role.
CTGIMR006E An error occurred while retrieving a
role for the user.
Explanation: The system was not able to create a role
based on the provided input.
Explanation: The system was not able to retrieve a
role for the user.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR002E An error occurred while deleting a
role.
CTGIMR007E
Explanation: The system was able to delete the role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR003E An error occurred while updating the
role.
Explanation: The system was not able to update the
role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR004E An error occurred while retrieving
detailed information for the role.
Explanation: The system was not able retrieve
detailed information for the role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR005E An error occurred while retrieving
the members for the role.
Explanation: The system was not able to retrieve the
members for the role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
108
The user already exists.
Explanation:
Administrator response:
CTGIMR008E An error occurred while adding
members to the role.
Explanation: The system was not able to add
members to the role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR009E An error occurred while removing
members from the role.
Explanation: The system was not able to remove
members from the role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR010E An error occurred while retrieving
container of the role.
Explanation: The system was not able to retrieve the
container of the role.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR011E The static and dynamic roles cannot
be deleted at the same time because
only dynamic roles support scheduling.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMR012E • CTGIMR023E
Explanation: Dynamic roles need to be scheduled;
therefore, you cannot delete dynamic roles with static
roles.
User response: You cannot select both static and
dynamic roles to be deleted. Select either static or
dynamic roles.
CTGIMR012E There are IBM Security Privileged
Identity Manager users assigned to the
ITIM Groups.
Explanation: The ITIM Group has users assigned to
the group.
Administrator response: Remove any unused users
from the group.
CTGIMR013E The Identity Manager user already
exists.
Explanation: The Identity Manager already exists in
the ITIM Group.
User response: Check your selection and try again.
CTGIMR014E
The ITIM group already exists.
Explanation: See message.
Administrator response: Do not create another ITIM
group.
CTGIMR018E An error occurred while retrieving
detailed information of the ITIM group.
Explanation: The system was not able to retrieve
detailed information for the ITIM group.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR019E An error occurred while retrieving
ITIM user of the ITIM group.
Explanation: The system was not able to retrieve an
ITIM user of the ITIM group.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR020E An error occurred while adding one
or more users to the ITIM Group.
Explanation: The system was not able to add users to
the ITIM Group.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR021E An error occurred while removing
one or more users to the ITIM Group.
CTGIMR015E An error occurred while creating an
ITIM Group.
Explanation: The system was not able to remove users
to the ITIM Group.
Explanation: The system was not able to create an
ITIM Group based on the provided input.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR022E An error occurred while retrieving
ITIM admin user from the ITIM group.
CTGIMR016E An error occurred while deleting an
ITIM Group.
Explanation: The system was not able to retrieve ITIM
admin user from the ITIM group.
Explanation: The system was not able to remove the
ITIM Group.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR017E An error occurred while updating the
ITIM Group.
Explanation: The system not able to update the ITIM
Group.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR023E An error occurred while creating an
ITIM Group. Group [group_name]
already exists.
Explanation: The system was not able to create the
ITIM group because the group for the given name
already exists. Please use different name.
User response: Use different name for the group then
try it again.
Messages
109
CTGIMR024E • CTGIMR035E
CTGIMR024E The specified view cannot be found.
The view may have been deleted.
CTGIMR030W Child role member_role_name is
already a descendant role of role_name.
Explanation: The system was not able to provide the
view because the view with the specified identifier
does not exist.
Explanation: The role to be added as a child role to
the specified role is already a descendant.
User response: Try searching for the view name or
description to verify that it exists.
CTGIMR031W Failed to add new role inheritance
role_name_1 -> role_name_2
CTGIMR025E The specified view cannot be deleted
because it is in use.
Explanation: Make sure that the Identity Manager
database is configured properly and connected.
Explanation: The system cannot delete the view if it is
assigned to one or more groups.
CTGIMR032W Invalid Graph Implementation Class
class_name role_name_2
User response: Remove all references to this view and
try the operation again. To remove all references to a
view, either 1) assign a different view to every group
referencing it, or 2) remove every group that references
the view.
Explanation: Verify the Identity Manager
configuration data.
CTGIMR026E The child roles specified in the input
collection are not of the supported input
types.
Explanation: The child roles must all be static
organizational roles.
User response: Check the Java documetation for
supported input parameter type.
CTGIMR027E The dynamic role dynamic_role_name is
not supported within the role
hierarchies.
Explanation: Only static roles can be added as
children of a static role.
User response: Check that both the parent and child
roles are static roles.
CTGIMR028E Failed to add child role
member_role_name to role_name.
Explanation: A cycle error occurred while trying to
add the specified relationship to the role hierarchy.
User response: Check that the child role to be added
is not already an ancestor of the parent role.
CTGIMR029E The role role_name could not be
deleted because it is in use by one or
more separation of duty policies:
policy_names.
Explanation: The role is in use by one or more
separation of duty policies. It cannot be deleted until
the role is removed from the policies listed.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
110
CTGIMR033E The role role_name could not be
deleted because it is included as a role
target in one or more recertification
policies: policy_names.
Explanation: The role is in use by one or more user
recertification policies. It cannot be deleted until the
role is removed from the policies listed.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMR034E The role role_name cannot be added as
a child of parent_role because it will
cause the following separation of duty
policy violations. Policy/rule violated:
sod_name
Explanation: If the child is added to the parent role, a
separation of duty policy violation will occur.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the separation of duty policies that
were violated.
CTGIMR035E
The system could not create the role.
Explanation: The role that you are creating does not
contain a valid container.
User response: Create the role again and specify a
container. Either create a container or select an existing
container for the role. The value cannot be null. A
container can be an Organization, Organization Unit,
Business Partner Organization, Location, or Admin
Domain. If the problem persists, contact your system
administrator.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMR036E • CTGIMS003W
Programmer response: The container parameter
cannot be null.
CTGIMR036E
The system could not create the role.
Explanation: The scope for creating a dynamic role
was not defined.
User response: Create the role again and specify the
scope of the dynamic role. Refer to the IBM Security
Privileged Identity Manager information center or Java
documentation for possible scope values. If the problem
persists, contact your system administrator.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Programmer response: Set the erScope property of the
role to one of the possible scope values.
CTGIMR037E The system cannot retrieve the
requested role information.
populated by the database configuration utility in the
{ITIM_HOME}/bin directory during the installation.
There are two options to fix the problem: Try to run the
DBConfig utility again. Note: this action will reverse
the ITIM database to the out-of-box state. Extract the
TASK_TREE insert statements from
{ITIM_HOME}/config/rdbms/itim_data.ddl into a ddl
file and manually execute the file against the ITIM
database.
CTGIMR039E The role assignment attribute
assignmentAttributeName_definedRole_assignedRole
is not valid for person_name. The defined
role and the assigned role are appended
to the attribute name.
Explanation: The specified assignment attribute is not
defined in any of authorized roles for a person or a
person is not directly a member of assigned role
specified. A role is authorized for a person if it is either
directly assigned or is inherited from the parent roles.
Explanation: Either the attribute name or its value
was not specified for the role information search. A null
value cannot be used.
User response: Use a valid role assignment attribute
to set the value for a person. If necessary, contact a
system administrator to add the attribute name to the
list of assignment attributes for the role.
User response: Supply the missing information and
try the search again. If the problem persists contact
your system administrator.
CTGIMR040E The role role_name is not an
authorized role for person_name.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
Explanation: The specified role is not an authorized
role for the specified person. A role is authorized for a
person if it is either directly assigned or is inherited
from the parent roles.
Programmer response: To search for a role, the
attributeName and attributeValue parameters cannot be
null.
CTGIMR041E The role either has members, or is
referred by provisioning policies.
CTGIMR038E There are no tasks defined in the
TASK_TREE table.
Explanation: You cannot delete a role that has
members or is referred by provisioning policies.
Explanation: TASK_TREE table either didn't get
populated during installation time, or the data was
wiped out for some reason.
User response: Remove all user members and child
roles from the role, also remove the role from
provisioning policies. Then try the operation again.
Administrator response: The TASK_TREE table is
Container management messages
CTGIMS001E
At least one required attribute is
missing.
Explanation: One or more required attributes are
missing from the request.
Administrator response: Specify a value for each
required attribute, and retry the operation.
CTGIMS002E
At least one specified attribute
violates the schema.
Explanation: The request contains one or more
attribute values that are not allowed by the governing
schema.
Administrator response: Ensure that all attributes are
consistent with the restrictions of the schema, and try
the operation again.
CTGIMS003W The search results exceed the
maximum of limit_number items. The
results are truncated to the maximum
amount.
Explanation: The number of items that meet the
Messages
111
CTGIMS004W • CTGIMS014E
search criteria exceeds the maximum search limit. Only
the items returned up to the limit are displayed.
Administrator response: Narrow your search criteria
or reset the search limit to a higher value.
CTGIMS004W The search results exceed the
maximum of limit_number items. The list
is truncated to the maximum amount.
Explanation: The number of items that meet the
search criteria exceeds the maximum search limit. Only
the items returned up to the limit are displayed in the
list.
Administrator response: Narrow your search criteria
or reset the search limit to a higher value.
CTGIMS005E
The default administrator cannot be
removed from the System Administrator
group.
CTGIMS009E
You do not have the authority to
perform this operation.
Explanation: An access control item does not allow
you to perform the specified operation.
User response: Contact your system administrator to
obtain the authority to perform the operation.
CTGIMS010E
Some of the selected users cannot be
deleted.
Explanation: An access control item does not allow
you to delete some of the specified users.
User response: Contact your system administrator to
obtain the authority to delete the users that were not
deleted.
CTGIMS011E
Some of the selected users cannot be
suspended.
Explanation: The default administrator must always
remain in the System Administrator group.
Explanation: An access control item does not allow
you to suspend some of the specified users.
User response: A user-defined administrator can be
removed from the System Administrator group.
User response: Contact your system administrator to
obtain the authority to suspend the users that were not
suspended.
CTGIMS006E
You have specified yourself as your
supervisor or sponsor. You must specify
another user as your supervisor or
sponsor.
Explanation: A user cannot set himself as his
supervisor or sponsor.
CTGIMS012E
Some of the selected users cannot be
restored.
Explanation: An access control item does not allow
you to restore some of the specified users.
User response: Specify another user as your
supervisor or sponsor, and try the operation again.
User response: Contact your system administrator to
obtain the authority to restore the users that could not
be restored.
CTGIMS007E
CTGIMS013E
The specified user cannot be found.
The user might be deleted already.
Explanation: The user cannot be found in the
directory server. The user might have been deleted
before your request was completed.
User response: Verify that the user exists, and try the
operation again. If the error occurs again, review the
log files, beginning with the IBM Security Privileged
Identity Manager logs.
CTGIMS008E
You do not have the authority to
perform this operation.
Explanation: An access control item does not allow
you to perform the specified operation.
User response: Contact your system administrator to
obtain the authority to perform the operation.
112
Some of the selected users cannot be
transferred.
Explanation: An access control item does not allow
you to transfer some of the specified users.
User response: Contact your system administrator to
obtain the authority to transfer the users that were not
be transferred.
CTGIMS014E
You do not have the authority to
change the organizational role of the
user.
Explanation: An access control item does not allow
you to change the role of the user.
User response: Contact your system administrator to
obtain the authority to change the role of the user.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMS015E • CTGIMS025E
CTGIMS015E
The organization or business unit is
not selected.
CTGIMS020E
You do not have the authority to
modify personal information.
Explanation: The specified request requires that you
select an organization or business unit.
Explanation: An access control item does not allow
you to modify personal information.
User response: Select an organization or a business
unit, and try the operation again.
User response: Contact your system administrator to
obtain the authority to modify personal information.
CTGIMS016E
CTGIMS021E
The following error occurred while
checking for access authorization:
server_error.
Explanation: The request did not complete because an
error occurred during processing.
User response: Try the operation again. If the problem
persists, contact your system administrator.
Administrator response: Complete these steps: Using
the error message that is displayed, try to correct the
cause of the error. Try the operation again. If the
problem persists, review the log files, beginning with
the IBM Security Identity Manager logs.
CTGIMS017W You are about to perform an
operation on the following IBM Security
Privileged Identity Manager accounts
that belong to one or more delegates.
Do you want to continue?
itim_account_ids
Explanation: You are about to delete or suspend
accounts of users that are delegates for other users. If
you continue, those other users cannot continue to
delegate tasks to the users that own these accounts.
User response: You can continue or cancel the
operation.
CTGIMS018W You are about to perform an
operation on the following users who
are delegates. Do you want to continue?
list_of_user_names
Explanation: You are about to delete or suspend users
that are delegates for other users. If you continue, those
other users cannot continue to delegate tasks to the
users that you have specified to suspend or delete.
User response: You can continue or cancel the
operation.
Explanation: The System Administrator is a
mandatory user that cannot be deleted.
User response: Contact your system administrator to
determine which user needs to be deleted.
CTGIMS022E
You do not have the authority to
perform the specified operation on the
following users: user_names.
You do not have the authority to
transfer users to a selected business
unit.
Explanation: An access control item does not allow
you to transfer the specified users to the selected
business unit.
User response: Contact your system administrator to
obtain the authority to transfer users to a business unit.
CTGIMS023E
A class was not selected for the user
that is being added.
Explanation: A class must be specified when adding a
user to the system.
User response: Select a class for the new user, and try
the operation again.
CTGIMS024E
The syntax of the filter is invalid.
Please correct the filter so that it is a
valid LDAP search filter.
Explanation: The provided filter could not be saved or
run because it does not conform to the syntax rules of
an LDAP filter.
User response: Complete these steps: Verify that
parenthesis are balanced, special characters are escaped,
and other syntax rules are followed. Try the operation
again. If the problem persists, review the log files,
beginning with the IBM Security Identity Manager logs.
CTGIMS025E
CTGIMS019E
The System Administrator cannot be
deleted.
A user in user_organization_name
organization cannot have role_name role
in different organization
role_organization_name.
Explanation: An access control item does not allow
you to perform the specified operation on the users
that are displayed.
Explanation: If a user is in one organization then only
the roles from the same organization can be assigned to
this user.
User response: Contact your system administrator to
obtain the authority to perform the operation.
User response: Complete these steps: Verify that the
role is from the same organization where a user
Messages
113
CTGIMS026E • CTGIMS205E
belongs to. Try not to assign a role from a different
organization to a user. If the problem persists, review
the log files, beginning with the IBM Security Identity
Manager logs.
CTGIMS026E
A user in user_organization_name
organization cannot have group_name
group in different organization
group_organization_name.
Explanation: If a user is in one organization then only
the groups from the same organization can be assigned
to this user.
User response: Complete these steps: Verify that the
group is from the same organization where a user
belongs to. Try not to assign a group from a different
organization to a user. If the problem persists, review
the log files, beginning with the IBM Security Identity
Manager logs.
Administrator response: Review the log files to
determine the source of the error. If you cannot isolate
the problem, check IBM Electronic Support for
additional information -www.ibm.com/software/
sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMS202E
Explanation: The business unit associated with your
request was not found. It might have been deleted by
another user before this request completed.
User response: Ensure that the business unit still
exists. If the business unit is still in the system, try the
operation again. If the problem persists, contact your
system administrator.
CTGIMS203E
CTGIMS101E
The end date cannot be earlier than
the start date.
Explanation: The specified end date must be the same
as or later than the specified start date.
User response: Ensure that the end date is the same
as or later than the start date, and try the operation
again.
CTGIMS102E
The delegated user cannot be
changed.
Explanation: Changing a delegated user is not
allowed. To change delegates, delete the existing user
as a delegate and specify another user as the new
delegate.
User response: Delete the existing delegation, then
specify the user that you want add as the new delegate.
CTGIMS103E
The delegation period cannot overlap
with an existing delegation period.
Explanation: Only one delegate can be specified for a
given period of time. Delegation periods cannot
overlap.
User response: Change the delegation period to
ensure that it does not overlap with an existing
delegation, and try the operation again.
CTGIMS201E
An error occurred while retrieving the
profile name of an organization entity.
Explanation: The profile name the organization entity
associated with the request cannot be retrieved because
an error occurred during processing.
User response: Try the operation again. If the problem
persists, contact your system administrator.
114
The business unit cannot be located.
It might have been deleted by another
user.
An error occurred while trying to
delete the business partner unit.
Explanation: The business partner unit associated
with your request cannot be deleted because an error
occurred during processing. It might have been deleted
by another user before this request completed.
User response: Ensure that the business partner unit
still exists. If it is still in the system, try the operation
again. If the problem persists, contact your system
administrator.
CTGIMS204E
The organization or the business unit
cannot be deleted because it is not
empty.
Explanation: The organization or the business unit
cannot be deleted if it contains one or more users or
other entities.
User response: Delete all the items in the organization
or the business unit, then try the operation again.
CTGIMS205E
An error occurred while trying to
create an organization or a business
unit.
Explanation: The specified organization or business
unit cannot be created because an error occurred
during processing.
User response: Try the operation again. If the problem
persists, contact your system administrator.
Administrator response: Review the log files,
beginning with the IBM Security Identity Manager logs.
If you cannot isolate the problem, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMS206E • CTGIMT009E
CTGIMS206E
The organization cannot be located. It
might have been deleted by another
user.
Explanation: The organization associated with your
request was not found. It might have been deleted by
another user before this request completed.
User response: Ensure that the organization still
exists. If the organization is still in the system, try the
operation again. If the problem persists, contact your
system administrator.
CTGIMS207E
Explanation: A server error occurred while processing
your request. The request did not complete.
User response: Try the operation again. If the problem
persists, contact your system administrator.
Administrator response: Review the log files,
beginning with the IBM Security Identity Manager logs.
If you cannot isolate the problem, check IBM Electronic
Support for additional information
-www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
An error occurred while processing
your request.
Adapter management messages
CTGIMT001E The following error occurred. Error:
error_text
Explanation: The IBM Tivoli Directory Integrator
could not communicate with the target managed
resource.
Administrator response: Verify that the target
managed resource is accessible or operational.
CTGIMT002E The login credential is missing or
incorrect.
Explanation: The adapter requires login credentials to
connect to the managed resource. The credential is
either invalid or missing in the request.
Administrator response: Verify that the login
credential on the adapter service form is valid.
CTGIMT003E
The account already exists.
Explanation: Accounts with the same name cannot be
defined for the same managed resource.
Administrator response: Check that the account does
exist on the managed resource. Start a reconciliation to
synchronize the IBM Security Privileged Identity
Manager and the managed resource accounts.
Explanation: All of the required attributes were not
supplied to the adapter
Administrator response: Verify that all of the required
attributes to add an account are marked as required on
the account form.
CTGIMT006E The incorrect_password password is not
valid.
Explanation: The managed resource did not accept the
account password.
Administrator response: Verify the password policy
on the managed resource and reflect it on the IBM
Security Privileged Identity Manager server.
CTGIMT007E A system error occurred while adding
an account. The account is not added.
Error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about this error. The actual system error is provided in
the error message.
CTGIMT004E The adapter does not have permission
to add an account: no_permission
CTGIMT008W The account was added, but some
attributes failed. Attributes:
failed_attributes
Explanation: The administrative user specified for the
adapter does not have permission to add an account.
Explanation: The account was added successfully, but
the adapter failed to set optional attributes.
Administrator response: The adapter login credential
may not have permission to add an account. Verify the
adapter service login credential on the managed
resource.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about this error. Verify that the adapter login credential
has permission to set all attributes on the account. The
actual system error is provided in the error message.
CTGIMT005E The required attributes are missing
from the request. Attributes:
missing_attributes
CTGIMT009E The account_name cannot be modified
because it does not exist.
Messages
115
CTGIMT010E • CTGIMT019W
Explanation: The requested account does not exist on
the managed resource and cannot be modified.
Administrator response: Validate that the account
does not exist on the managed resource. You may need
to issue a reconciliation request to synchronize the IBM
Security Privileged Identity Manager accounts and the
managed resource accounts.
CTGIMT010E The adapter does not have permission
to modify the account. no_permission
Explanation: The administrative user specified for the
adapter does not have permission to modify the
account.
Administrator response: The adapter login credential
may not have permission to modify an account. Verify
the adapter service login credential on the managed
resource.
CTGIMT011E There were no attributes passed to
the adapter in the request.
Explanation: No attributes were supplied to the
adapter in the request.
Administrator response: Review the trace.log file for
additional information.
CTGIMT012E One or more required attributes are
missing in the request. Attribute:
missing_attributes
Explanation: All of the required attributes were not
supplied to the adapter.
Administrator response: Verify that all of the required
attributes are marked as required on the account form.
CTGIMT013E A system error occurred while
modifying the account. The account is
not modified. Error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Review the adapter log file
located on the IBM Tivoli Directory Integrator server.
CTGIMT014W The account was modified, but some
attributes failed. failed_attributes Error:
error_text
Explanation: The account was modified, but the
adapter failed to set optional attributes.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about this error. Verify that the adapter login credential
has permission to set all attributes on the account. The
actual system error is supplied in the error message.
116
CTGIMT015E An error occurred while deleting the
account_name account because the
account does not exist.
Explanation: The requested account does not exist on
the managed resource and cannot be deleted.
Administrator response: Validate that the account
does not exist on the managed resource. You may need
to issue a reconciliation request to synchronize the IBM
Security Privileged Identity Manager accounts and the
managed resource accounts.
CTGIMT016E The adapter does not have permission
to delete the account: no_permission
Explanation: The administrative user specified for the
adapter does not have permission to delete the account.
Administrator response: The adapter login credential
may not have permission to delete an account. Verify
the adapter service login credential on the managed
resource.
CTGIMT017E One or more required attributes are
missing in the request. Attributes:
missing_attributes
Explanation: All of the required attributes were not
supplied to the adapter.
Administrator response: Verify that all of the required
attributes to delete an account are specified in the
service.def file.
CTGIMT018E A system error occurred while
deleting an account. The account is not
deleted. Error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT019W The account was deleted
successfully, but additional steps failed:
error_text
Explanation: The account was deleted successfully, but
the adapter failed to perform the additional steps
requested.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. Verify that the adapter login credential
has permission to perform the additional steps. The
actual system error is supplied in the error message.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMT020E • CTGIMT203E
CTGIMT020E The adapter does not have permission
to search: no_permission
CTGIMT026E The account was not restored:
error_text
Explanation: The administrative user specified for the
adapter does not have permission to retrieve the
account data.
Explanation: The adapter failed to restore the account.
Administrator response: The adapter login credential
may not have permission to retrieve account data.
Verify the adapter service login credential on the
managed resource.
CTGIMT021E The required attribute was not passed
in the request: missing_attributes
Explanation: All of the required attributes were not
supplied to the adapter.
Administrator response: Verify that all of the required
attributes to delete are specified in the service.def file.
CTGIMT022E The search failed due to a system
error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT023W
Administrator response: The adapter login credential
may not have permission to restore an account. Verify
the adapter service login credential on the managed
resource. The actual system error is supplied in the
error message.
CTGIMT027E Connector parameter param_name has
a value that is not valid: param_value
Explanation: The connector cannot operate using the
value for the specified parameter. Change the
parameter value.
Administrator response: Change the value for the
specified parameter by providing a different value on
the service or account form. See the adapter user guide
for information about service and account form
attributes. If you do not know which value to change,
use the form designer to find the attribute name. Open
the form for the service or account type used in the
operation. Navigate through the tabs in the designer to
look for an attribute name that closely matches the
connector parameter name. The attribute indicates the
form item that must be changed. Note that the attribute
names in the form designer are all lower-case while the
connector parameter name is mixed-case. Ignore the
case differences.
The account is already suspended.
Explanation: The account is already suspended on the
managed resource.
CTGIMT201E No login or an invalid credential was
supplied in the request.
Administrator response: The account is already
suspended on the managed resource. Review the IBM
Tivoli Directory Integrator log files for additional
information about the error.
Explanation: The adapter requires login credentials to
connect to the managed resource. The credentials are
either invalid or not included in the request.
CTGIMT024E The account was not suspended:
error_text
Explanation: The adapter failed to suspend the
account.
Administrator response: The adapter login credential
may not have permission to suspend an account. Verify
the adapter service login credential on the managed
resource. The actual system error is supplied in the
error message.
CTGIMT025W
The account is already restored.
Explanation: The account is already restored on the
managed resource.
Administrator response: The account is already
restored on the managed resource. Review the IBM
Tivoli Directory Integrator log files for additional
information about the error.
Administrator response: Verify that the login
credentials on the adapter service form are valid.
CTGIMT202E The adapter failed to add the account:
adapter_error
Explanation: The request failed and the account was
not added.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT203E The required attributes were not
passed in the request: missing_attributes
Explanation: All of the required attributes were not
supplied to the adapter.
Administrator response: Verify that all of the required
attributes are marked as required on the account form.
Messages
117
CTGIMT204E • CTGIMT214E
CTGIMT204E The request failed due to an IBM
Tivoli Directory Integrator error: idi_error
Explanation: The request failed due to an IBM Tivoli
Directory Integrator error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT205E The request failed due to a system
error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT206W The account was added, but some
attributes failed: failed_attributes;
error_text
Explanation: The account was added successfully, but
the adapter failed to set optional attributes.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. Verify that the adapter login credential
has permission to set all attributes on the account. The
actual system error is supplied in the error message.
CTGIMT207E The adapter failed to modify the
account: adapter_error
Explanation: The request failed at the adapter level.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT208E The required attribute(s) were not
passed in the request: missing_attributes
Explanation: Not all of the required attributes were
supplied to the adapter
Administrator response: Verify that all the required
attributes to modify an account are marked as such on
the account form.
CTGIMT209E No attributes were passed in to the
request.
Explanation: No attributes were supplied to the
adapter in the request.
any attributes in the request. View the trace.log file to
validate.
CTGIMT210E The request failed due to an IBM
Tivoli Directory Integrator error: idi_error
Explanation: The request failed due to an IBM Tivoli
Directory Integrator error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT211E The account was not modified due to
a system error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT212W The account was modified, but some
attributes failed: failed_attributes;
error_text
Explanation: The account was modified, but the
Adapter failed to set optional attributes.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. Verify that the adapter login credential
has permission to set all attributes on the account. The
actual system error is supplied in the error message.
CTGIMT213E The required attribute(s) were not
passed in the request: missing_attributes
Explanation: Not all of the required attributes were
supplied to the Adapter
Administrator response: Verify that all the required
attributes to delete an account are specified is
service.def file.
CTGIMT214E The account was not deleted due to
an IBM Tivoli Directory Integrator error:
idi_error
Explanation: The account was not deleted due to an
IBM Tivoli Directory Integrator error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
Administrator response: The adapter could not detect
118
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMT215E • CTGIMT226E
CTGIMT215E The account was not deleted due to a
system error: error_text
CTGIMT221E Search failed due to a system error:
error_text
Explanation: The adapter could not determine the
managed resource error.
Explanation: The Adapter could not determine the
managed resource error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT216W The account was deleted
successfully, but additional steps failed:
error_text
CTGIMT222W
Explanation: The account was deleted successfully, but
the Adapter failed perform the additional steps
requeted.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. Verify the adapter login credential have
enough permission to perform the additional steps. The
actual system error is supplied in the error message.
CTGIMT217E The required attribute(s) were not
passed in the request: missing_attributes
Explanation: Not all of the required attributes were
supplied to the Adapter
Administrator response: Verify that all the required
attributes to delete an account are specified is
service.def file.
CTGIMT218E The search failed due to an IBM
Tivoli Directory Integrator error: idi_error
Explanation: The request failed due to an IBM Tivoli
Directory Integrator error.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT219E
Search filter error: filter_error
Explanation: The request failed due to an error from
the filter component.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT220E
Invalid search filter: filter_error
Explanation: The search filter entered on with the
reconciliation request is invalid.
Administrator response: View and validate the search
filter entered on with the reconciliation request.
The account is already suspended.
Explanation: The account is already suspended on the
managed resource.
Administrator response: The account is already
suspended on the managed resource. Review the IBM
Tivoli Directory Integrator log files for additional
information about the error.
CTGIMT223E The account was not suspended:
error_text
Explanation: The adapter failed to suspend the
account.
Administrator response: The adapter login credential
may not have permission to suspend an account. Verify
the adapter service login credential on the managed
resource. The actual system error is supplied in the
error message.
CTGIMT224W
The account is already restored.
Explanation: The account is already restored on the
managed resource.
Administrator response: The account is already
restored on the managed resource. Review the IBM
Tivoli Directory Integrator log files for additional
information about the error.
CTGIMT225E The account was not restored:
error_text
Explanation: The adapter failed to restore the account.
Administrator response: The adapter login credential
may not have permission to restore an account. Verify
the adapter service login credential on the managed
resource. The actual system error is supplied in the
error message.
CTGIMT226E Failed to add the group due to system
error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Verify that the adapter login
credential has permission to set all attributes on the
account. Review the IBM Tivoli Directory Integrator log
Messages
119
CTGIMT227W • CTGIMT235E
files for additional information about the error. The
actual system error is supplied in the error message.
files for additional information about the error. The
actual system error is supplied in the error message.
CTGIMT227W The group was added, but some
attributes failed: failed_attributes;
error_text
CTGIMT232E The group cannot be added because it
already exists: error_text
Explanation: The group was added successfully, but
the adapter failed to set optional attributes.
Administrator response: Verify that the adapter login
credential has permission to set all attributes on the
account. Review the IBM Tivoli Directory Integrator log
files for additional information about the error. The
actual system error is supplied in the error message.
CTGIMT228E Failed to modify the group due to a
system error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Verify that the adapter login
credential has permission to set all attributes on the
account. Review the IBM Tivoli Directory Integrator log
files for additional information about the error. The
actual system error is supplied in the error message.
CTGIMT229W The group was modified, but some
attributes failed: failed_attributes;
error_text
Explanation: The account was modified, but the
Adapter failed to set optional attributes.
Administrator response: Verify that the adapter login
credential has permission to set all attributes on the
account. Review the IBM Tivoli Directory Integrator log
files for additional information about the error. The
actual system error is supplied in the error message.
CTGIMT230E Failed to delete the group due to a
system error: error_text
Explanation: The adapter could not determine the
managed resource error.
Administrator response: Verify that the adapter login
credential has permission to set all attributes on the
account. Review the IBM Tivoli Directory Integrator log
files for additional information about the error. The
actual system error is supplied in the error message.
CTGIMT231W The group was deleted successfully,
but additional steps failed: error_text
Explanation: The group was deleted successfully, but
the Adapter failed perform the additional steps
requeted.
Explanation: A group with the same name or ID
already exists on the managed resource.
Administrator response: Verify that the group name
was entered correctly. If it was not, enter the name and
try the operation again. If it was entered correctly,
verify that the adapter login credential has permission
to set all attributes on the account. Review the IBM
Tivoli Directory Integrator log files for additional
information about the error. The actual system error is
supplied in the error message.
CTGIMT233E The adapter does not have permission
to add group: error_text
Explanation: The adapter does not have permission to
add group
Administrator response: Grant the adapter login
credential the necessary permissions to set all attributes
on the group. Review the IBM Tivoli Directory
Integrator log files for additional information about the
error. The actual system error is supplied in the error
message.
CTGIMT234E The group cannot be added because a
group with the GID {0} already exists:
error_text
Explanation: The group cannot be added because a
group with the same GID already exists
Administrator response: Verify that the group ID was
entered correctly. If it was not, enter the ID and try the
operation again. If it was entered correctly, verify that
the adapter login credential has permission to set all
attributes on the account. Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT235E The adapter does not have permission
to modify group: error_text
Explanation: The adapter does not have permission to
modify groups
Administrator response: Grant the adapter login
credential the necessary permissions to set all attributes
on the group. Review the IBM Tivoli Directory
Integrator log files for additional information about the
error. The actual system error is supplied in the error
message.
Administrator response: Verify that the adapter login
credential has permission to set all attributes on the
account. Review the IBM Tivoli Directory Integrator log
120
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMT236E • CTGIMT243E
CTGIMT236E Group {0} cannot be modified because
it does not exist: error_text
CTGIMT240E Length of the group name is not
valid: error_text
Explanation: A group must already exist before the
modify operation can be performed on it
Explanation: A group name must conform to the
length requirements of the resource. The group cannot
be added because the group name length is not valid.
See your resource system documentation for specific
group name limitations.
Administrator response: Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. Verify that the adapter login credential
has permission to set all attributes on the account. The
actual system error is supplied in the error message.
CTGIMT237E Group {0} cannot be deleted because
it does not exist: error_text
Explanation: A group must already exist before the
delete operation can be performed on it
Administrator response: Verify that the group was
entered correctly. If it was not, enter the group and try
the operation again. If it was entered correctly, verify
that the group exists on the managed resource. If it
does not, no action is necessary. If it does, verify that
the adapter login credential has permission to set all
attributes on the account. Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT238E The adapter does not have permission
to delete group: error_text
Explanation: The adapter does not have permission to
delete group
Administrator response: Verify that the group was
entered correctly. If it was not, enter the group and try
the operation again. If it was entered correctly, verify
that the group exists on the managed resource. If it
does not, no action is necessary. If it does, verify that
the adapter login credential has permission to set all
attributes on the account. Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT239E Length of the group name is not
valid: error_text
Explanation: A group name must conform to the
length requirements of the resource. The group cannot
be added because the group name length is not valid.
See your resource system documentation for specific
group name limitations.
Administrator response: Use a group name so that
conforms to the resource requirements and perform the
add operation again. Review the IBM Tivoli Directory
Integrator log files for additional information about the
error. The actual system error is supplied in the error
message.
Administrator response: Use a group name so that
conforms to the resource requirements and perform the
modify operation again. Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT241E Length of the group name is not
valid: error_text
Explanation: A group name must conform to the
length requirements of the resource. The group cannot
be added because the group name length is not valid.
See your resource system documentation for specific
group name limitations.
Administrator response: Use a group name so that
conforms to the resource requirements and perform the
add operation again. Review the IBM Tivoli Directory
Integrator log files for additional information about the
error. The actual system error is supplied in the error
message.
CTGIMT242E Length of the group name is not
valid: error_text
Explanation: A group name must conform to the
length requirements of the resource. The group cannot
be added because the group name length is not valid.
See your resource system documentation for specific
group name limitations.
Administrator response: Use a group name so that
conforms to the resource requirements and perform the
modify operation again. Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
CTGIMT243E The group cannot be modified
because a group with the GID already
exists: error_text
Explanation: The group cannot be modified because a
group with the same GID already exists
Administrator response: Verify that the group ID was
entered correctly. If it was not, enter the ID and try the
operation again. If it was entered correctly, verify that
the adapter login credential has permission to set all
attributes on the account. Review the IBM Tivoli
Directory Integrator log files for additional information
about the error. The actual system error is supplied in
the error message.
Messages
121
CTGIMT244E • CTGIMT408E
CTGIMT244E The group cannot be modifed
because the new name exists: error_text
Explanation: A group with the same name or ID
already exists on the managed resource.
Administrator response: Verify that the group name
was entered correctly. If it was not, enter the name and
try the operation again. If it was entered correctly,
verify that the adapter login credential has permission
to set all attributes on the account. Review the IBM
Tivoli Directory Integrator log files for additional
information about the error. The actual system error is
supplied in the error message.
CTGIMT400E An error occurred while loading the
agent_name agent. Error: error_text
Explanation: The IBM Tivoli Directory Integrator
cannot correctly load and bind the agent. The XML
definition for the agent contains an error.
Administrator response: Review the error text for
details. Check the XML definition for syntax and
coding errors.
CTGIMT401E An error occurred while starting the
agent_name agent. Error: error_text
Explanation: The IBM Tivoli Directory Integrator
detected an unrecoverable error while starting the
agent.
request to this adapter was idle for a long period of
time.
CTGIMT404E The IBM Tivoli Directory Integator
cannot find the agent_name agent in the
current configuration.
Explanation: The configuration does not have the
specified agent loaded. The provider should handle this
error.
Administrator response: If the user sees this error, it
points to a configuration error or a defect.
CTGIMT405E The operation cannot be completed
because either the IBM Security
Privileged Identity Manager server or
the IBM Tivoli Directory Integrator
server is being shutdown.
Explanation: New operations cannot be processed
when a shutdown is in progress.
Administrator response: Ensure that no requests are
received after a shutdown is called on the dispatcher.
CTGIMT406E The IBM Tivoli Directory Integrator
detected the following error. Error:
error_text
Explanation: An internal error occurred.
Administrator response: Ensure that the IBM Tivoli
Directory Integrator instance is running with the correct
configuration. Review the error text for details.
Administrator response: Review the error text for
details. Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMT402E An error occurred while running the
agent_name agent. Error: error_text
CTGIMT407E The result returned by the agent_name
agent is not correct.
Explanation: The IBM Tivoli Directory Integrator
detected an unrecoverable error starting the agent. The
JavaScript contained in the agent may contain errors.
Explanation: The IBM Tivoli Directory Integrator
detected an error with the agent. The agent does not
function as expected for the resource.
Administrator response: Ensure that the IBM Tivoli
Directory Integrator instance is running with the correct
configuration. Review the error text for details. Check
that the JavaScript code in agent does not contain a
syntax or coding errors.
Administrator response: Review the agent to ensure it
meets the requirements for the managed resource. If the
code is part of the product, an internal error exists.
Check IBM Electronic Support for additional
information -www.ibm.com/software/sysmgmt/
products/support/index.html?ibmprd=tivman.
CTGIMT403E The id ID used to obtain the
continuation of requested search data is
no longer valid. The data cannot be
retrieved. Issue the search again.
CTGIMT408E The filter specified with the request
is invalid. The reported error is :
search_filter
Explanation: The search resulted in data that must be
presented in segments. This message is the result of a
long delay between receiving a segment of data and
requesting the next segment of data. The ID used to
retrieve the data is no longer available.
Explanation: IBM Security Privileged Identity
Manager supports a search filter that is compliant with
the LDAP standards. Ensure that the filter is compliant
with LDAP. The filter only supports equality filters on
attributes.
Administrator response: Verify that a reconciliation
Administrator response: Ensure that the filter
122
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMT600E • CTGIMT609E
complies with IBM Security Privileged Identity
Manager specifications.
CTGIMT600E An error occurred while establishing
communication with the Tivoli
Directory Integrator server. Error:
error_text
Explanation: A connection with the Tivoli Directory
Integrator server cannot be established.
Administrator response: Verify that the Tivoli
Directory Integrator server instance is running with the
correct configuration. Check the security configurations
on the IBM Tivoli Directory Integrator server and the
adapter service form on the IBM Security Privileged
Identity Manager server.
CTGIMT601E An error occurred while uploading
the agent to the IBM Tivoli Directory
Integrator server. Error: error_text
Explanation: The agent could not be loaded to the
IBM Tivoli Directory Integrator server.
Administrator response: Verify that the IBM Tivoli
Directory Integrator server instance is running with
correct configuration and validate the adapter service
form on the IBM Security Privileged Identity Manager
server.
CTGIMT602E The agent definition cannot be found
in the LDAP directory.
Explanation: The agent is not in the LDAP directory.
Either the agent is not in the LDAP directory or a
different error caused the problem.
Administrator response: Use an LDAP browser to
locate the agent in the LDAP directory. Review the IBM
Security Privileged Identity Manager log files for
additional information about the error.
CTGIMT603E The agent was not uploaded to IBM
Tivoli Directory Integrator.
Explanation: The Remote Method Invocation provider
failed to upload the agent to IBM Tivoli Directory
Integrator.
Administrator response: Verify that the IBM Tivoli
Directory Integrator instance is running with the correct
configuration. Review the IBM Security Privileged
Identity Manager log files for additional information
about the error.
CTGIMT604E An error occurred while processing
the operation_name operation
configuration. The operation is not
valid.
Explanation: The operation failed because of an
operation configuration parsing error in the service.def
file.
Administrator response: Correct the operation
configuration in the adapter profile and import the
adapter profile again.
CTGIMT605E An error occurred while processing
the operation operation on the IBM Tivoli
Directory Integrator server. Error:
error_text
Explanation: The operation failed on IBM Tivoli
Directory Integrator.
Administrator response: Verify that the IBM Tivoli
Directory Integrator instance is running with correct
configuration. Review the IBM Security Privileged
Identity Manager log files for additional information
about the error.
CTGIMT606E
The account name was not found.
Explanation: The account name was not found for the
entryDN in LDAP.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMT607W The account attributes were not
found.
Explanation: The account attributes were not found.
Some attributes may be corrupt.
Administrator response: Verify that the account exists.
Review the IBM Security Privileged Identity Manager
log files for additional information about the error.
CTGIMT608W A Remote Method Invocation
dispatcher error occurred while
processing a reconciliation.
Explanation: The Remote Method Invocation
dispatcher returned a null value as the search status so
the reconciliation did not complete.
Administrator response: Review the Remote Method
Invocation dispatcher log file located on the IBM Tivoli
Directory Integrator.
CTGIMT609E An error occurred while establishing
SSL communication with the IBM Tivoli
Directory Integrator server. The error is
as follows: reported exception
Explanation: An SSL connection with the IBM Tivoli
Directory Integrator server cannot be established.
Administrator response: Verify that the IBM Tivoli
Directory Integrator server instance is running with the
correct configuration. Check the security configurations
Messages
123
CTGIMW001W • CTGIMW009E
on the IBM Tivoli Directory Integrator server and the
adapter service form on the IBM Security Privileged
Identity Manager server. Also ensure that the IBM
Tivoli Directory Integrator server certificate is trusted
by the IBM Security Privileged Identity Manager
provider. If client authentication is enabled, also ensure
that the IBM Security Privileged Identity Manager
server certificate is trusted by the IBM Tivoli Directory
Integrator server.
Service Center messages
CTGIMW001W
File not found: file_name
Explanation: The server was unable to find the
requested file.
Administrator response: Review the ISPIM server logs
for more details about the file that cannot be found.
CTGIMW002E
Error reading file: file_name
Explanation: The server encountered an unexpected
error while reading a requested file.
User response: The problem may be transient. Retry
the operation. If the problem persists, contact your
system administrator.
Administrator response: Review the ISPIM server logs
to determine the file that caused the read error. Check
the file to verify it is not a directory and has the
appropriate security permissions.
CTGIMW003E Unable to determine the location of
the root directory for customized files.
Explanation: The server was unable to determine the
location of the directory where customized files are
found.
Administrator response: Customized versions of files
are maintained under the config directory of the
WebSphere Application Server cell. The location of the
directory is determined using the
USER_INSTALL_ROOT and WAS_CELL environment
variables of the application server. Review the runtime
environment for the server and verify that these
environment variables are defined correctly.
the IBM Security Privileged Identity Manager
application or in communicating with the WebSphere
Application Server environment.
Administrator response: Verify that the WebSphere
Application Server environment hosting IBM Security
Privileged Identity Manager is started and available.
Review the system and error logs for the WebSphere
Application Server environment for additional error
messages that indicate the root cause of the problem. If
you cannot correct the problem, check IBM Electronic
Support for additional information at
www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
CTGIMW006E Unable to determine the location of
the ITIM_HOME directory.
Explanation: The server was unable to determine the
location of the Identity Manager home directory.
Administrator response: Customized versions of some
files are maintained in the data directory under the
Identity Manager home directory. The Identity Manager
server uses the Java classpath to determine the location
of this directory. Make sure the ITIM_HOME/data
directory is specified on the Java classpath of the
WebSphere Application Server hosting Identity
manager, and that there is a Property.properties file in
the ITIM_HOME/data directory.
CTGIMW008E Your session expired. You were
logged out.
Explanation: For security reasons, a session is ended if
its idle time exceeds the time out limit set on the
system. Your session exceeded that limit.
CTGIMW004E The ruleName Separation of Duty
policy detected that these set of access
or roles are conflicting: accessorRoleName.
User response: Log back into the Identity Service
Center.
Explanation: There is a conflict between the access
requested or the existing roles that the person has.
CTGIMW009E You were logged off because your
session became invalid.
User response: You can perform one of the following
actions: Remove the conflicting access from the
selection.
Explanation: You logged in as separate users in the
same browser. Identity Service Center cannot verify
your credentials when you return to the user that you
previously logged in as. For security reasons, you must
reauthenticate.
CTGIMW005E An application error or
communication error occurred. If the
problem persists, contact your system
administrator.
User response: Log back into the Identity Service
Center.
Explanation: An unexpected error occurred, either in
124
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMW010E • CTGIMX002E
CTGIMW010E The new account information on {0}
is not compliant for the following
accesses: {1}.
Explanation: The new account request form has
attributes that are not compliant.
User response: Open the Provide account information
page and correct the attributes that are not compliant.
CTGIMW011E The new account information on {0}
is not compliant, and contains
validation errors for the following
accesses: {1}.
Explanation: The new account request form has
attributes that are not compliant and also has
validation errors.
User response: Open the Provide account information
page and correct the attributes for compliance and
validation errors.
CTGIMW012E The new account information on {0}
contains validation errors for the
following accesses: {1}.
Explanation: The new account request form has
attributes that contain validation errors.
the group membership access.
User response: Select one or more accounts to resolve
the error in the request access.
CTGIMW015E A configuration issue occurred with
the person card. The access request
cannot proceed.
Explanation: The person card configuration is not
correct due to one of the following reasons: Parsing
error in the person card customization file. The primary
section of the person card does not contain a valid
LDAP attribute (valid schema) for the profile of the
selected user. The default attribute that is specified for
a section does not cover all the person profiles.
User response: If the problem persists, contact your
system administrator.
Administrator response: Open the person card
customization file in a text editor to point and fix any
JSON parsing errors. Provide the valid LDAP attributes
for the person profile in the primary section.
CTGIMW016E The <b>{0}</b> activity is no longer
valid because the requisite action is
taken on this activity.
User response: Open the Provide account information
page and correct the attributes for validation errors.
CTGIMW017E The <b>{0}</b> activity cannot be
completed. The activity is locked by
another user.
CTGIMW013E The Provide required information
page contains validation errors. The {0}
field is required.
Explanation: The operation cannot complete because
another user owns the activity. The activity is locked.
Explanation: One of the required fields does not
contain any value in the Provide required information
page.
User response: Enter the value for the field that is
specified in the message text, and then submit the
request again.
CTGIMW014E The Provide required information
page contains validation errors for the
access request on {0} and for the
following accesses {1}. Select at least one
account to proceed.
Explanation: You must select at least one account for
Administrator response: Wait until the activity is
unlocked and try the operation again.
An error occurred while completing a locked activity
for the activity management component. A message is
written to the log file.
CTGIMW018E <b>{0}</b> out of <b>{1}</b>
selected activities failed.
Explanation: The operation cannot complete for the
failed activities.
Administrator response: Review the IBM Security
Privileged Identity Manager server logs for more
details.
Privileged identity management and data synchronization
CTGIMX001E The service profile profile_name could
not be found.
Explanation: The service profile does not exist in the
directory server.
Programmer response: Verify that the service profile
name was spelled and entered correctly. If the service
profile name was entered correctly, ensure that you
have installed the service profile.
CTGIMX002E cred_name on service_name is currently
checked out.
Explanation: You cannot remove a credential that is
checked out.
Messages
125
CTGIMX003E • CTGIMX011E
User response: Check in the credential first, then
remove it from the vault.
CTGIMX003E The account_name account of
service_name is invalid for the vault.
Explanation: The system was unable to add the
account to the vault because the account is inactive,
orphan, individual, ISPIM account, or already in the
vault.
CTGIMX004E pool_name is referenced by shared
access policies: policy_names.
Explanation: You cannot delete a credential pool that
is referenced by shared access policies.
User response: Remove the credential pool from the
shared access policies first, then try the operation again.
CTGIMX005E You are not authorized to assign
groups group_names to pool pool_name on
service_name.
Explanation: You need to be granted with Assign
Group to Pool operation permission for the groups.
User response: Contact your system administrator to
obtain the authority to assign the groups to the
credential pool.
CTGIMX006E The organizational container of
poolName has been modified. The pool
needs to be removed, then recreated in
the new container. You are not
authorized to remove the pool.
Explanation: To change the organizational container
for a pool, you must have Remove permission for the
existing pool, and Add permission to create the pool in
the new container.
User response: Contact your system administrator to
obtain the authority to remove the old pool and create
the new pool.
CTGIMX007E The organizational container of
poolName has been modified. The pool
needs to be removed, and recreated in
the new container. You are not
authorized to create the pool in the new
container.
Explanation: To change the organizational container
for a pool, you must have Remove permission for the
existing pool, and Add permission to create the pool in
the new container.
User response: Contact your system administrator to
obtain the authority to remove the old pool and create
the new pool.
126
CTGIMX008E The following credentials and
credential pools are not available under
the current policy business unit scope:
entitlement_names_list
Explanation: The credential or credential pool are not
available under the current policy business unit scope
setting.
User response: Complete these steps: Removed the
specified credentials or credential pools from the
entitlements and try the operation again. Or increase
the policy business unit scope or change the business
unit if possible. If the problem persists, contact your
system administrator.
Administrator response: Complete these steps:
Removed the specified credentials or credential pools
from the entitlements and try the operation again. Or
increase the policy business unit scope by making this
policy available to the business and its subunits or
change the business unit if possible. If the problem
persists, review the log files, beginning with the IBM
Security Identity Manager logs.
CTGIMX009E The organizational container of
policyName has been modified. The
policy needs to be removed, then
recreated in the new container. You are
not authorized to remove the policy.
Explanation: To change the organizational container
for a policy, you must have Remove permission for the
existing policy, and Add permission to create the policy
in the new container.
User response: Contact your system administrator to
obtain the authority to remove the old policy and
create the new policy.
CTGIMX010E The organizational container of
policyName has been modified. The
policy needs to be removed, and
recreated in the new container. You are
not authorized to create the policy in the
new container.
Explanation: To change the organizational container
for a policy, you must have Remove permission for the
existing policy, and Add permission to create the policy
in the new container.
User response: Contact your system administrator to
obtain the authority to remove the old policy and
create the new policy.
CTGIMX011E The role role_name could not be
deleted because it is included as a role
target in one or more shared access
policies: policy_names.
Explanation: The role is in use by one or more user
shared access policies. It cannot be deleted until the
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMX012E • CTGIMX022E
role is removed from the policies listed.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMX012E cred_name is referenced by shared
access policies: policy_names.
Explanation: You cannot delete a credential that is
referenced by shared access policies.
User response: Remove the credential from the shared
access policies first, then try the operation again.
CTGIMX013E You are not authorized to perform
this operation: missing Write permission
on attribute attrName.
Explanation: You must have Write permission for the
attribute.
User response: Contact your system administrator to
obtain the attribute permission.
CTGIMX014E The organizational container of the
policy has been modified. The policy
needs to be removed, and recreated in
the new container. You are not
authorized to create the policy in the
new container: missing Write permission
on attribute attrName.
Explanation: You must have Write permission for the
attribute.
User response: Contact your system administrator to
obtain the attribute permission.
CTGIMX016E The system does not support the
specified time unit time_unit.
Explanation: The supported time units are hour, day,
and week.
Administrator response: Ensure that
max.checkout.duration in pim.properties is set to one of
the supported time units.
CTGIMX017E userName is not authorized to check in
credName.
Explanation: To check in a credential, the user must
be the current lease holder or must be authorized to
check in the credential on behalf of other users.
Administrator response: Grant the user permission to
check in the credential on behalf of other users.
CTGIMX018E An error occured while checking in
credName.
Explanation: Server encountered an error while
checking in the credentials.
User response: Contact the IBM Security Privileged
Identity Manager administrator.
Administrator response: Ensure that the workflow
component is working properly. You can review the
IBM Security Privileged Identity Manager log files for
additional information about the error.
CTGIMX019E You are not authorized to check in
the list of credentials specified.
Explanation: To check in a credential, you must be the
current lease holder or must be authorized to check in
on behalf of other users.
User response: Contact the IBM Security Privileged
Identity Manager administrator to get the
authorization.
CTGIMX020E You are not authorized to view the
password without first checking out the
credential.
Explanation: This type of credential requires that you
must check out the credential in order to view the
password.
User response: Check out this credential before trying
to view the password. To check out the credential you
must be authorized by the shared access policy.
CTGIMX021E The shared access policy does not
authorize you to view the password.
Explanation: You must be authorized by the shared
access policy to view the password.
User response: Contact your system administrator to
obtain the authority to view the password.
Administrator response: Update the shared access
policy to allow a requester to view the password of a
credential.
CTGIMX022E You cannot view the password of a
non-shared credential.
Explanation: If the credential is configured as a
non-shared credential you cannot view the password.
User response: Contact your system administrator to
obtain the authority to view the password.
Administrator response: Update the appropriate
credential property to designate this credential as a
shared credential. Next, update the shared access policy
to allow authorized users to view the password.
Messages
127
CTGIMX023W • CTGIMX032E
CTGIMX023W Fail to change password at remote
resources.
CTGIMX029E Account userId on serviceName cannot
be shared.
Explanation: The account has been added to
credential vault, however there was a problem resetting
the password on the remote resource.
Explanation: The access mode of the credential must
be set to Credential.AccessMode.NONSHARED.
User response: Check the availability of the remote
resource. Use the register password function to reset
the password on the remote resource.
Administrator response: Check if the remote service
and network is functioning properly. You can review
the IBM Security Privileged Identity Manager log files
for additional information about the error.
CTGIMX024E Account userId is already in the
credential vault.
Explanation: See message.
User response:
CTGIMX025E The business unit buName is not valid
for the credential pool poolName.
Explanation: The business unit does not contain the
service for the credential pool.
User response: Select a business unit that contains the
service and try again.
CTGIMX026W Fail to reset the password at remote
resources.
Explanation: The credential is not checked in because
there was a problem resetting the password on the
remote resource.
User response: Check the availability of the remote
resource and try the operation again.
Administrator response: Check if the remote service
and network is functioning properly. You can review
the IBM Security Privileged Identity Manager log files
for additional information about the error.
CTGIMX027E The account userId does not have an
owner.
Explanation: You cannot check out an account that is
an orphan.
User response: Assign the account to a person
responsible for sharing. Or remove the credential from
vault.
CTGIMX028E
userId has credential in the vault.
Explanation: You cannot change the ownership type
of an existing account in the vault to Individual.
User response: Set the access mode of the credential
as non-shared.
Programmer response: Set the access mode of the
credential as non-shared.
CTGIMX030E Credential userId on serviceName is
already in the credential vault.
Explanation: You cannot add a credential with the
same user ID on the same service to the credential
vault more than once.
User response: You cannot have two credentials with
the same user ID on the same service. You can either
specify a different user ID for the credential or search
for the credential and update its information.
Programmer response: You cannot have two
credentials with the same user ID on the same service.
You can either specify a different user ID for the
credential or search for the credential and update its
information.
CTGIMX031E The service UID serviceUID is not
valid for the credential.
Explanation: The specified unique identifier (UID) of
the service is invalid for the credential. The service UID
cannot contain any spaces and cannot be empty or null.
User response: You must specify a valid unique
identifier for the service of the credential. Specify a
valid unique identifier for the service and try again.
Programmer response: You must specify a valid
unique identifier for the service of the credential.
Specify a valid unique identifier for the service and try
again.
CTGIMX032E Service UID serviceUri already exists.
You are not authorized to modify the
service information.
Explanation: The specified service UID already exists.
You must either be granted Modify operation
permission for the service information, or specify a
different service UID.
User response: Specify a different service UID value
or contact the system administrator to grant you the
required permission.
Administrator response: Grant the user permission to
modify the service info.
User response: Select a non-individual ownership type
during adoption.
128
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMX033E • CTGIMX044E
CTGIMX033E Service UID serviceUri already exists.
You are not authorized to use the service
information.
CTGIMX039E Credential acctID on serviceName
already exists. You can connect the
credential to the account.
Explanation: The specified service UID already exists.
You must either be granted Search operation
permission for the service information, or specify a
different service UID.
Explanation: The credential already exists but not
connected to the account. You can connect the
credential to the account.
User response: Specify a different service UID value
or contact the system administrator to grant you the
required permission.
Administrator response: Grant the user permission to
search the service info.
CTGIMX034E Service UID serviceUri already exists.
You do not have Write permission for
attribute attrName.
Explanation: The specified service UID already exists.
The attribute value you specified is different from the
existing value. You must either be granted Write
attribute permission for that attribute, or specify a
different service UID.
User response: Specify a different service UID value
or contact the system administrator to grant you the
required permission.
Administrator response: Grant the user permission to
modify the service info.
CTGIMX035E Credential credential_name cannot be
connected to account account_name.
Explanation: The system was unable to connect the
credential to the account because the account is
inactive, or is an orphan or individual account or
already in vault.
CTGIMX036E Credential Name credential_nameis
different from account user ID
account_user_id; therefore, the credential
cannot be connected to the account.
Explanation: The system was unable to connect the
credential to the account because the credential name is
different from the account user id.
CTGIMX037E Credential credential_nameis already
connected to the specified account.
Explanation: The credential is alreday connected.
CTGIMX038E Credential credential_nameis not
connected to any account.
User response: Connect the existing credential to the
account.
CTGIMX040E An invalid service type service_type is
specified for the resource of a credential
credential_name.
Explanation: An invalid service type is specified for
the resource of a credential.
User response: Use a valid service type. A valid
service type is the actual service type name such as
LdapProfile, PosixAixProfile, PosixHpuxProfile,
PosixLinuxProfile, and PosixSolarisProfile.
CTGIMX041E ISPIM Service or Hosted ISPIM
service is not found in organization
orgName.
Explanation: To create a PIM user in an secondary
organization, you need to define a hosted ISPIM
service.
User response: Contact the system administrator.
CTGIMX042E The following attribute(s) are invalid
for PIM user: attrNames.
Explanation: Invalid LDAP attribute names are
specified for PIM user.
User response: Correct the attribute names.
CTGIMX043E User ID account_name is already used
by an existing ISPIM user.
Explanation: Either an ISPIM account with the
specified user ID already exists, or it is being used as
the preferred user ID of a person.
User response: Specify a different user ID.
CTGIMX044E Administrative domain specified by
adminDomainName is not found or is not
administered by userName.
Explanation: Domain may have been removed or is
invalid or domain administrator may have been
changed
User response: Contact the system administrator.
Explanation: The credential is not connected to any
account.
Messages
129
CTGIMX200E • CTGIMX210E
CTGIMX200E The data synchronization could not
connect to the synchronization target.
Explanation: Either a connection to the target is not
available or the target itself is not available.
User response: Check the IBM Security Privileged
Identity Manager log file for more detailed information.
(1) If the error comes from the IBM Security Privileged
Identity Manager default data synchronization handler,
check the database connection and the driver. (2) If the
error comes from the custom data synchronization
handler, check the provider for more detailed
information.
CTGIMX201E The data synchronization cannot
update target repository while trying to
perform: sql
Explanation: This error occurs because of a target
error. For example, a network error occurs or the target
is suddenly unavailable during the data
synchronization.
User response: Check the IBM Security Privileged
Identity Manager log file for more detailed information.
(1) If the error comes from the IBM Security Privileged
Identity Manager default data synchronization handler,
check the database connection and the driver. (2) If the
error comes from the custom data synchronization
handler, check the provider for more detailed
information.
CTGIMX202E The object is not found in the target
repository: dn
Explanation: Either the object distinguished name is
invalid, or the object might have been removed by
another client.
User response: Contact the IBM Security Privileged
Identity Manager administrator to get the
authorization.
CTGIMX205E
The account userID is suspended.
Explanation: You cannot check out a suspended
account.
User response: Restore the account first and then try
it again.
CTGIMX206E The account userID does not have a
password registered in the credential
vault.
Explanation: You cannot check out an account without
a password.
User response: Register the password for the account
first and then try it again.
CTGIMX207E The account userId is currently
checked out by another user.
Explanation: You cannot check out an account that is
used by other users.
User response: Try to check out again later.
CTGIMX208E The pool poolName does not have any
members.
Explanation: The credential vault does not contain any
accounts that meet the pool rule definition.
User response: Contact the IBM Security Privileged
Identity Manager administrator to add accounts to the
vault.
User response: Check if the object distinguished name
is correct.
CTGIMX209E The pool poolName does not have any
members available for checkout at this
time.
CTGIMX203E The search provider is not configured
in {ITIM_HOME}/data/
dataSynchronization.properties for
enroleClass.
Explanation: The pool members might have been
checked out by other users. Or, they might be
suspended or do not have passwords registered.
Explanation: The operation requires that the
{ITIM_HOME}/data/dataSynchronization.properties
file specify the search provider for object category.
User response: Try to check out later again. If the
problem persists, contact the IBM Security Privileged
Identity Manager administrator.
User response: Contact the IBM Security Privileged
Identity Manager administrator to add a property in
this format:
search.{enroleClass}={searchProviderClassName}
CTGIMX210E The Pool credName does not have rule
definition.
CTGIMX204E You are not authorized to check out
credName.
User response: Contact the IBM Security Privileged
Identity Manager administrator to specify the rule for
the pool.
Explanation: You are not granted the roles to access
the credentials or credential pools.
130
Explanation: The pool members cannot be resolved
without rule definition.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMX211E • CTGIMX218E
CTGIMX211E The checkout operation operation_name
is not a supported operation.
Explanation: An internal error occurred during
checkout. The checkout operation could not be found
or is not supported.
User response: Define a global life cycle operation
with an operation name to invoke the checkout
workflow extension. Verify that the checkout operation
name set in the Default Credential Settings matches the
name of the operation defined.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMX212E The data synchronization component
failed to create the following object:
Object class: objType dn: attrVals
Attribute values: attrVals
Explanation: A database error occurred when creating
the object during data synchronization.
User response: Refer to the IBM Security Privileged
Identity Manager Problem and Recovery
documentation to recover the lost data in the target
database for each object class.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMX213E The data synchronization component
failed to update the following object:
Object class: objType dn: attrVals
Attribute values: attrVals
Explanation: A database error occurred when
updating the object during data synchronization.
User response: Refer to the IBM Security Privileged
Identity Manager Problem and Recovery
documentation to recover the lost data in the target
database for each object class.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMX214E The data synchronization component
failed to delete the following object:
Object class: objType dn: attrVals
Attribute values: attrVals
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error.
CTGIMX215E Failed to create object (DN=obj_dn,
name=obj_name) in the database. This
object is out of sync between LDAP and
the database.
Explanation: Failed to create object in the database
when synchronizing data from LDAP to the database.
Administrator response: This error is logged in the
dataSynchronizationErr.log file. You can manually log
on to the administrative console and update this object
to trigger data synchronization.
CTGIMX216E Failed to update object (DN=obj_dn,
name=obj_name) in the database. The
attributes listed ()modified_attributes)
might be out of sync between LDAP
and the database.
Explanation: Failed to update attribute values of
object in the database when synchronizing data from
LDAP to the database.
Administrator response: This error is logged in
dataSynchronizationErr.log file. You can manually log
on to the administrative console and update this object
to trigger data synchronization.
CTGIMX217E Failed to obtain object profile for
object (DN=obj_dn, name=obj_name)
during data synchronization.
Explanation: Failed to obtain object profile
information.
Administrator response: This is not an expected error.
This error is most likely caused by un-supported
operations added to the server via custom extensions.
Contact Identity Manager Support to furhter
troubleshoot the issue.
CTGIMX218E Failed to release update lock for
object (DN=obj_dn).
Explanation: Failed to release update lock for an
object.
Administrator response: You can connect to the
database and manually delete the object entry in the
SYNCH_OBJECT_LOCK table, and you can look up the
object by its distinguished name.
Explanation: A database error occurred when deleting
the object during data synchronization.
User response: Refer to the IBM Security Privileged
Identity Manager Problem and Recovery
documentation to recover the lost data in the target
database for each object class.
Messages
131
CTGIMY001E • CTGIMY112E
Web Services messages
CTGIMY001E The specified session identifier does
not match the one stored in web
services context.
Explanation: The specified session identifier does not
match the one stored in web services context.
CTGIMY002E An application exception occurred
during the search of the authorized
shared access.
Explanation: An internal error occurred. Review the
IBM Security Privileged Identity Manager log file,
trace.log, for additional information about the error.
CTGIMY003E Login Failure. The following error
occurred: Error: msg_text.
Explanation: Login authentication failed. The specified
user ID and password are not valid, have expired, or
have been disabled.
CTGIMY004E An internal error occurred while
checking in the credentials.
Explanation: Review the IBM Security Privileged
Identity Manager log file, trace.log, for additional
information about the error.
CTGIMY005E An internal error occurred while
getting the credential.
Explanation: Review the IBM Security Privileged
Identity Manager log file, trace.log, for additional
information about the error.
CTGIMY006E An internal error occurred while
getting credential attributes.
Explanation: Review the IBM Security Privileged
Identity Manager log file, trace.log, for additional
information about the error.
CTGIMY007E An internal error occurred while
checking out the credential.
Explanation: Review the IBM Security Privileged
Identity Manager log file, trace.log, for additional
information about the error.
CTGIMY101E
Explanation: Review the IBM Security Privileged
Identity Manager log file, trace.log, for additional
information about the error.
CTGIMY102E A name exception has occurred while
resolving the Java Naming and
Directory Interface (JNDI) cache name.
Explanation: Review the IBM Security Privileged
Identity Manager log file, trace.log, for additional
information about the error.
CTGIMY106E The session is invalid. Web services
cannot execute the ws_operation_name
operation.
Explanation: The session ID does not match with any
of the available session ID's.
Administrator response: Login and try the execute the
operation again.
CTGIMY111E
Account modify request ignored for
account accountDN : No changes were
found.
Explanation: The list of WSAttributes given to the
modify or update operation on the specified account,
does not contain any changes.
Administrator response: Specify the WSAttributes to
modify the specified account, and retry the operation.
CTGIMY112E Class specified in
SearchResultsWrapper (
search_wrapper_class_name ) and serialized
results object's class (
resultMO_class_name )does not match.
Explanation: The current method is passed an
instance of SearchResultsWrapper. The results class
expected through this SearchResultsWrapper, has a
different value than the cached searchResults.
Administrator response: Set the right value of the
results class in the SearchResultsWrapper; and retry the
operation.
CTGIMY008E The service cannot be found by
serviceURI_or_serviceDN.
Explanation: The service cannot be found because the
specified unique resource identifier or the distinguished
name is not valid.
132
The class class_name is not found.
IBM Security Privileged Identity Manager: Error Message Guide
CTGIMZ001E • CTGIMZ019E
IBM Security Privileged Identity Manager REST services
CTGIMZ001E An internal server error occurred
while performing the task. The error is
error
Explanation: An unexpected error occurred on the
server while performing the operation.
Administrator response: Check the log files for
detailed error information.
CTGIMZ002E An error occurred while connecting to
the remote server.
Explanation: The requested task cannot be performed
because of an error connecting to the Identity Manager
server.
Administrator response: Check the log files for
detailed error information.
CTGIMZ003E An exception occurred while parsing
the URI. The error is error
Explanation: An exception occurred while parsing the
URI. This might occur if the URI is not valid or
corrupt.
Administrator response: Check the log files for
detailed error information.
CTGIMZ004E A general failure occurred while
searching through the repository. The
error is error
Explanation: The repository failed to perform the
search operation either because the repository is down
or the request was not valid.
Administrator response: Check log files for detailed
error information.
CTGIMZ011E The identifier reference in the URI is
either corrupt or not valid.
Explanation: The identifier reference in the URI is
either corrupt or not valid.
Administrator response: Verify that the URI is
submitted exactly as it was received.
CTGIMZ012E A valid value is required for the
HTTP header X-HTTP-Method-Override.
Explanation: Either no value was specified, or an
incorrect value was specified for this HTTP header.
Administrator response: Check the documentation
and verify that the correct value is specified for this
HTTP header.
CTGIMZ013E The category reference in the URI is
either corrupt or not valid.: parameter
Explanation: The category reference in the URI is
either corrupt or not valid.
Administrator response: Verify that the category
reference in the URI contains a valid value.
CTGIMZ014E The filter parameter is either not
formatted correctly or contains an
invalid value: parameter
Explanation: The filter parameter is either not
formatted correctly or contains an invalid value.
Administrator response: Verify that the filter
parameter syntax is correct and has a valid value.
CTGIMZ015E The query parameter is missing:
parameter
Explanation: The required query parameter is missing
from the URI.
Administrator response: Verify that the URI contains
the required query parameter and has a valid value.
CTGIMZ016E The query parameter either is not
formatted correctly or contains an
invalid value: parameter
Explanation: The query parameter either is not
formatted correctly or contains an invalid value.
Administrator response: Verify that the query
parameter syntax is correct and has a valid value.
CTGIMZ017E A parameter was missing from the
body of the HTTP request: parameter
Explanation: The HTTP request requires that a
parameter be included in the PUT or POST body.
Administrator response: Verify that the PUT or POST
body of the HTTP request is formatted correctly.
CTGIMZ018E The value specified for the old
password is not correct.
Explanation:
Administrator response: Verify the old password and
provide a valid value.
CTGIMZ019E The password change request did not
complete successfully.
Explanation: The password change request was
submitted, but did not complete successfully.
Messages
133
CTGIMZ020E • CTGIMZ052E
Administrator response: Check the request status to
find the reason why the password change did not
succeed.
CTGIMZ020E The header parameter is missing:
parameter
Explanation: The required header parameter is
missing from the HTTP request.
Administrator response: Verify that the HTTP request
contains the required header parameter and has a valid
value.
CTGIMZ021E The search sort parameter is not valid
or exceeds the maximum number of
sorting fields: parameter
Explanation: The search sort parameter is not valid or
exceeds the maximum number of sorting fields.
Administrator response: Verify that the number of
specified sorting fields does not exceed the maximum
limit.
CTGIMZ022E The search range parameter is either
formatted incorrectly or does not fall
within a valid range: parameter
CTGIMZ025E The header parameter either is not
formatted correctly or contains an
invalid value: parameter
Explanation: The header parameter either is not
formatted correctly or contains an invalid value.
Administrator response: Verify that the header
parameter syntax is correct and has a valid value.
CTGIMZ051E HTTP POST request data has an
invalid data structure for field parameter.
Explanation: The HTTP POST request data has an
invalid data structure.
Administrator response: Verify that body of the HTTP
POST request is formatted correctly.
CTGIMZ052E HTTP POST request data has a
missing data for required field parameter.
Explanation: The HTTP POST request data has a
missing data value.
Administrator response: Verify that the body of the
HTTP POST request is formatted correctly.
Explanation: The specified range parameter is either
formatted incorrectly or does not fall within a valid
range.
Administrator response: Verify that the search range
parameter syntax is correct and is within the scope of
search results.
CTGIMZ023E The search limit parameter is either
formatted incorrectly or exceeds the
maximum limit: parameter
Explanation: The search limit parameter is either
formatted incorrectly or exceeds the maximum limit.
Administrator response: Verify that the search limit
parameter syntax is correct and does not exceed the
maximum limit.
CTGIMZ024E The search filter is missing the
requestee parameter.
Explanation: The requestee parameter is required in
the search filter.
Administrator response: Verify that the HTTP request
contains the required requestee in the filter parameter
with a valid value.
134
IBM Security Privileged Identity Manager: Error Message Guide
CTGSAA001E • CTGSAC005E
Shared access messages
CTGSAA001E The account for credential userId
could not be found.
Explanation: The system could not locate the account
for the credential when connecting the credential to the
identity provider.
Administrator response: Review the IBM Security
Privileged Identity Manager log files for additional
information about the error. Fix the error and try
connecting the credential to an identity provider again.
CTGSAA002E You are not authorized to remove
resourceName.
Explanation: You do not have the authority to remove
the resource. Contact the system administrator to grant
you the required permissions.
Administrator response: Grant the user permission to
remove a resource.
CTGSAA003E The resource resourceName cannot be
deleted because it has existing
credential or entity associations.
Explanation: The resource cannot be deleted if it
contains associations with existing credentials or other
entities.
Administrator response: Remove the credential or
other entity dependencies that are associated with the
resource, then try the operation again.
CTGSAB001E
object is not found: id.
Explanation: The specified object is not found. The
object either does not exist or you do not have the
authority to look up the object.
Programmer response: Make sure the object identifier
is correct and you have the the authority to look up the
object.
CTGSAB002E ISPIM account is not found for
userName.
Explanation: Either the ISPIM account does not exist,
or you don't have the authority to look up the ISPIM
account.
Programmer response: Make sure you have the the
authority to look up the ISPIM account.
CTGSAC001E
Your session expired.
Explanation: Your session has been idle for too long
and has expired.
CTGSAC002E
File not found: file_name
Explanation: The server was unable to find the
requested file.
Administrator response: Review the ISPIM server logs
for more details on the missing file.
CTGSAC003E
Error reading file: file_name
Explanation: The server encountered an unexpected
error while reading a requested file.
User response: The problem may be transient. Retry
the operation. If the problem persists, contact your
system administrator.
Administrator response: Review the ISPIM server logs
to determine the file error. Verify that the file is not a
directory and has the necessary security permissions.
CTGSAC004E Unable to determine the location of
the root directory for customized files.
Explanation: The server was unable to determine the
location of the directory where customized files are
found.
Administrator response: Customized versions of files
are maintained under the config directory of the
WebSphere Application Server cell. The location of the
directory is determined using the
USER_INSTALL_ROOT and WAS_CELL environment
variables of the application server. Review the runtime
environment for the server and verify that these
environment variables are defined correctly.
CTGSAC005E An application error or
communication error occurred. If the
problem persists, contact your system
administrator.
Explanation: An unexpected error occurred, either in
the IBM Security Privileged Identity Manager
application or in communicating with the WebSphere
Application Server environment.
Administrator response: Verify that the WebSphere
Application Server environment hosting IBM Security
Privileged Identity Manager is started and available.
Review the system and error logs for the WebSphere
Application Server environment for additional error
messages that indicate the root cause of the problem. If
you cannot correct the problem, check IBM Electronic
Support for additional information at
www.ibm.com/software/sysmgmt/products/support/
index.html?ibmprd=tivman.
User response: Log in again to the Identity Service
Center.
Messages
135
CTGSAC006E • CTGSAD006E
CTGSAC006E Unable to determine the location of
the ITIM_HOME directory.
CTGSAC032E Application instance {0} cannot be
found.
Explanation: The server was unable to determine the
location of the Identity Manager home directory.
Explanation: The application instance may have been
deleted or the user may not have the permission to
view and modify the application instance.
Administrator response: Customized versions of some
files are maintained in the data directory under the
Privileged Identity Manager home directory. The
Privileged Identity Manager server uses the Java
classpath to determine the location of this directory.
Make sure the ITIM_HOME/data directory is specified
on the Java classpath of the WebSphere Application
Server hosting Identity manager, and that there is a
Property.properties file in the ITIM_HOME/data
directory.
CTGSAC007E Login ID {0} already exist for resource
{1}.
Explanation: The specified login ID already exist in
the credential vault for the resource.
User response: Specify a login ID that is unique for
the resource in the credential vault.
CTGSAD001E The presented Access Token is
invalid.
Explanation: The presented access token cannot be
recognized or may have expired.
User response: Check that the correct access token for
the application instance is used in the login request.
CTGSAD002E The presented Refresh Token is
invalid.
Explanation: The presented refresh token cannot be
recognized.
User response: Check that the correct refresh token for
the application instance is used in the login request.
Check that the refresh token has not been used before.
CTGSAC008W The resource name {0} for an existing
credential was modified. If there are
other credentials that are associated with
the resource, the resource name for
these credentials will also be updated.
CTGSAD003E The presented fingerprint does not
match the server's record.
Explanation: The existing shared access policy for the
resource will not be effective if the resource name is
modified.
User response: Check that the application instance
and its running environment has not changed. If the
application instance or its environment has changed,
re-register the instance.
User response: The shared access policy needs to be
updated to reference the modified resource name.
CTGSAC013W The connection to the identity
provider cannot be established
successfully. Verify the information, and
try again.
Explanation: The connection to the identity provider
cannot be established with the information provided.
CTGSAC024E Resource name {0} already exist with
in this domain.
Explanation: The specified resource name already
exist in this domain.
User response: Specify a resource name that is unique
with in this domain.
Explanation: Some features in the application instance
fingerprint does not match the registered features.
CTGSAD004E The application instance is
suspended.
Explanation: The requested operation is not allowed
because the application instance is suspended.
User response: To allow the application instance to get
credentials, restore the instance.
CTGSAD005E The application instance cannot be
found.
Explanation: The application instance name may be
incorrect or the instance may have been deleted.
User response: Check that the application instance
name is correct.
CTGSAD006E
CTGSAC027E
Application {0} cannot be found.
Explanation: The application may have been deleted
or the user may not have the permission to view and
modify the application.
136
The OAuth authentication failed.
Explanation: A problem occurred while processing the
OAuth authentication request.
User response: Check the Identity server logs for
additional information about the problem.
IBM Security Privileged Identity Manager: Error Message Guide
CTGSAD007E • CTGSAE010E
CTGSAD007E The OAuth authentication failed
because the OAuth endpoint returns
statusCode.
Explanation: A problem occurred while processing the
OAuth authentication request.
User response: Check the Identity server logs for
additional information about the problem.
CTGSAE004E
The SSL keystore path is not correct.
Explanation: The client cannot save the SSL certificate
of the server because the stored or specified keystore
cannot be opened.
User response: Use the correct path in the command
line or use the install-certificate command to reinstall
the SSL certificate of the server.
CTGSAD008E The server failed to create an OAuth
client for the application instance.
CTGSAE005E
Explanation: A problem occurred while processing the
OAuth client creation request.
Explanation: Some parameters are not applicable for
the command or they contain invalid values.
User response: Check the Identity server logs for
additional information about the problem.
User response: Check the parameters that you have
passed to the command. See the command line usage:
AppID <command> -?.
CTGSAD009E The request for OAuth tokens failed
because the resource owner cannot be
authenticated.
Explanation: The username or password of the user is
incorrect.
User response: Check that the username and
password is entered correctly. Check the Identity server
logs for additional information about the problem,
which may be related to the user realm configuration.
CTGSAE001E
The SSL keystore password is not
correct.
Explanation: The client cannot save the SSL certificate
of the server in the keystore because the stored or
specified keystore password is not correct.
User response: Use the correct password in the
command line or use the install-certificate command to
reinstall your SSL certificate.
CTGSAE002E
The specified server URL cannot be
resolved or reached.
Explanation: The client failed to communicate with
the server because the server address cannot be
resolved or the network connectivity is lost.
User response: Ensure that the server name and port
is correct and check the network connectivity.
CTGSAE003E
The client cannot validate the SSL
certificate of the server.
Explanation: The communication with the server is
cancelled because the client does not receive the SSL
certificate of the server.
User response: Check the SSL configuration of the
server.
CTGSAE006E
Invalid parameters are passed to the
command.
The SSL certificate cannot be saved to
the keystore.
Explanation: The SSL keystore file might be corrupted.
User response: Delete the SSL keystore file and use
the install-certificate command to reinstall your SSL
certificate.
CTGSAE007E
The SSL keystore path or password is
not correct.
Explanation: The client cannot save the SSL certificate
of the server because the specified keystore cannot be
opened.
User response: Ensure that the SSL keystore path and
password that you specified are correct.
CTGSAE008E
The Java trust manager cannot be
initialized.
Explanation: SSL communication failed because the
Java trust manager cannot be initialized.
User response: Ensure that a supported version of
Java runtime is correctly installed in the system.
CTGSAE009E
The server cannot be reached.
Explanation: The client failed to communicate with
the server because the server address cannot be
resolved or the network connectivity is lost.
User response: Ensure that the server name and port
is correct and check the network connectivity.
CTGSAE010E
The specified user name or password
is not correct.
Explanation: The server rejects the specified Privileged
Identity Manager user name and password.
Messages
137
CTGSAE011E • CTGSAE022E
User response: Specify the correct user name and
password.
CTGSAE017E
CTGSAE011E
Explanation: The server returned an error when the
client attempted to list the credential entitlements.
The app instance {0} cannot be
authenticated.
Explanation: The server rejects the app instance
authentication request, either because the stored access
token is invalid, or the app instance is inactive.
User response: Check that the app instance name is
correct and that the account is active.
CTGSAE012E
The app instance {0} cannot be
created.
Explanation: The request to create the app instance
has failed. More information may be available when
verbose option is enabled.
User response: Check that the specified inputs are
valid and that the app instance name has not been
used.
CTGSAE013E
Access token refresh failed.
Explanation: The server rejects the access token
refresh request, either because the stored refresh token
is invalid, or the app instance fingerprint is different
from the registered one.
The client cannot get the list of
credential entitlements from the server.
User response: Check the Shared Access
configuration.
CTGSAE018E
There are no credential entitlements
that can be used.
Explanation: The client is only able to retrieve shared
credentials that do not require check-out and are not in
a credential pool.
User response: Check the Shared Access
configuration.
CTGSAE019E
The requested credential cannot be
retrieved.
Explanation: The server returned an error when the
client attempted to retrieve the shared credential.
User response: Check the Shared Access
configuration.
CTGSAE020E
The request status cannot be checked.
User response: Check that the app instance and the
environment have not been modified.
Explanation: An asynchronous request has been
submitted to the server, but the client received an error
while attempting to check if the request had been
fulfilled.
CTGSAE014E
User response: Check the server logs for errors.
Admin Domain ID of {0} cannot be
retrieved.
Explanation: The client cannot get the unique ID of
the Privileged Identity Manager administrative domain,
which is required to register an app instance.
User response: Check that the user is a domain
administrator.
CTGSAE015E
Saving the token store file to {0}
failed.
Explanation: The client cannot store the received
tokens from the server into the specified location, either
because it does not have write permission, or it is an
invalid path.
User response: Check that the path is correct and the
user has write permission to the folder.
CTGSAE016E
The operation failed. Refer to the log
at {0}.
CTGSAE021E
Explanation: An application with the requested name
already exists.
User response: If you are registering the first instance
of the application, choose a different application name.
If you intend to register an additional instance of an
existing application, use the register-additional-instance
command.
CTGSAE022E
The {0} application does not exist.
Explanation: There is no registered application with
the given name.
User response: If you are registering an additional
instance of an existing application, verify that the
application name is correct. If you are registering the
first instance of the application, use the
register-first-instance command.
Explanation: An unknown error has occurred. More
information may be available in the log file.
User response: Check the log file.
138
The {0} application already exists.
IBM Security Privileged Identity Manager: Error Message Guide
CTGSAE023E • CTGSAE031E
CTGSAE023E
The operation failed because of a data
conversion error.
Explanation: An internal data conversion error has
occurred. More information may be available in the log
file.
CTGSAE030E
The input for option {0} is invalid.
Explanation: The specified option switch is correct,
but its value is invalid.
User response: Check the correct syntax by running
the command line tool with -? switch.
User response: Check the log file.
CTGSAE031E
CTGSAE024E
The operation failed because of an
encryption error.
Explanation: An internal encryption error has
occurred. More information may be available in the log
file.
Some required parameters are
missing.
Explanation: Silent mode is enabled but some of the
required parameters for the command are not specified.
User response: Check the required parameters by
running the command line tool with -? switch.
User response: Check the log file.
CTGSAE025E
The SSL certificate cannot be
installed.
Explanation: The SSL communication with the server
is cancelled because the client cannot store the SSL
certificate of the server in the specified keystore.
User response: Check if you have permission to write
to the SSL keystore path.
CTGSAE026E
The log file cannot be initialized.
Explanation: The client cannot write runtime logs.
User response: Check that the user has write
permission to the system temporary folder.
CTGSAE027E
Class {0} cannot be found in jar file
{1}.
Explanation: The specified class has to be the main
class of the jar file.
User response: Specify the main class name in the
fully qualified format, for example:
com.ibm.sample.App.
CTGSAE028E
The access token cannot be retrieved
from the server.
Explanation: The server returned an error when the
client attempted to retrieve the access token for the
registered app instance.
User response: Check that the Application Identity
Manager feature is correctly activated in the server.
CTGSAE029E
Token file cannot be found.
Explanation: The access token for the app instance
cannot be found in the specified folder.
User response: Check that the path is correct and the
user has read permission on the folder.
Messages
139
140
IBM Security Privileged Identity Manager: Error Message Guide
Notices
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this document in
other countries. Consult your local IBM representative for information on the
products and services currently available in your area. Any reference to an IBM
product, program, or service is not intended to state or imply that only that IBM
product, program, or service may be used. Any functionally equivalent product,
program, or service that does not infringe any IBM intellectual property right may
be used instead. However, it is the user's responsibility to evaluate and verify the
operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not give you
any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.
For license inquiries regarding double-byte character set (DBCS) information,
contact the IBM Intellectual Property Department in your country or send
inquiries, in writing, to:
Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan, Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan
The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law :
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS
PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE.
Some states do not allow disclaimer of express or implied warranties in certain
transactions, therefore, this statement might not apply to you.
This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this IBM
product and use of those Web sites is at your own risk.
© Copyright IBM Corp. 2013, 2014
141
IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose
of enabling: (i) the exchange of information between independently created
programs and other programs (including this one) and (ii) the mutual use of the
information which has been exchanged, should contact:
IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758 U.S.A.
Such information may be available, subject to appropriate terms and conditions,
including in some cases payment of a fee.
The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement,
IBM International Program License Agreement or any equivalent agreement
between us.
Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments may
vary significantly. Some measurements may have been made on development-level
systems and there is no guarantee that these measurements will be the same on
generally available systems. Furthermore, some measurement may have been
estimated through extrapolation. Actual results may vary. Users of this document
should verify the applicable data for their specific environment.
Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available sources.
IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.
All statements regarding IBM's future direction or intent are subject to change or
withdrawal without notice, and represent goals and objectives only.
This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include the
names of individuals, companies, brands, and products. All of these names are
fictitious and any similarity to the names and addresses used by an actual business
enterprise is entirely coincidental.
COPYRIGHT LICENSE:
This information contains sample application programs in source language, which
illustrate programming techniques on various operating platforms. You may copy,
modify, and distribute these sample programs in any form without payment to
IBM, for the purposes of developing, using, marketing or distributing application
programs conforming to the application programming interface for the operating
platform for which the sample programs are written. These examples have not
been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or
imply reliability, serviceability, or function of these programs. You may copy,
modify, and distribute these sample programs in any form without payment to
142
IBM Security Privileged Identity Manager: Error Message Guide
IBM for the purposes of developing, using, marketing, or distributing application
programs conforming to IBM's application programming interfaces.
Each copy or any portion of these sample programs or any derivative work, must
include a copyright notice as follows:
© (your company name) (year). Portions of this code are derived from IBM Corp.
Sample Programs. © Copyright IBM Corp. 2012. All rights reserved.
If you are viewing this information in softcopy form, the photographs and color
illustrations might not be displayed.
Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of
International Business Machines Corp., registered in many jurisdictions worldwide.
Other product and service names might be trademarks of IBM or other companies.
A current list of IBM trademarks is available on the Web at “Copyright and
trademark information” at http://www.ibm.com/legal/us/en/copytrade.shtml.
Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered
trademarks or trademarks of Adobe Systems Incorporated in the United States,
other countries, or both.
IT Infrastructure Library is a registered trademark of the Central Computer and
Telecommunications Agency which is now part of the Office of Government
Commerce.
Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo,
Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or
registered trademarks of Intel Corporation or its subsidiaries in the United States
and other countries.
Linux is a trademark of Linus Torvalds in the United States, other countries, or
both.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.
ITIL is a registered trademark, and a registered community trademark of the Office
of Government Commerce, and is registered in the U.S. Patent and Trademark
Office.
UNIX is a registered trademark of The Open Group in the United States and other
countries.
Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Oracle and/or its affiliates.
Notices
143
Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the
United States, other countries, or both and is used under license therefrom.
Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are
trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.
Privacy Policy Considerations
IBM Software products, including software as a service solutions, (“Software
Offerings”) may use cookies or other technologies to collect product usage
information, to help improve the end user experience, to tailor interactions with
the end user or for other purposes. In many cases no personally identifiable
information is collected by the Software Offerings. Some of our Software Offerings
can help enable you to collect personally identifiable information. If this Software
Offering uses cookies to collect personally identifiable information, specific
information about this offering’s use of cookies is set forth below.
This Software Offering uses other technologies that collect each user's user name,
password or other personally identifiable information for purposes of session
management, authentication, single sign-on configuration, usage tracking, or
functional purposes. These technologies can be disabled, but disabling them will
also eliminate the functionality they enable.
This Software Offering does not use cookies to collect personally identifiable
information. The only information that is transmitted between the server and the
browser through a cookie is the session ID, which has a limited lifetime. A session
ID associates the session request with information stored on the server.
If the configurations deployed for this Software Offering provide you as customer
the ability to collect personally identifiable information from end users via cookies
and other technologies, you should seek your own legal advice about any laws
applicable to such data collection, including any requirements for notice and
consent.
For more information about the use of various technologies, including cookies, for
these purposes, see IBM’s Privacy Policy at http://www.ibm.com/privacy and
IBM’s Online Privacy Statement at http://www.ibm.com/privacy/details/us/en
sections entitled “Cookies, Web Beacons and Other Technologies” and “Software
Products and Software-as-a Service”.
144
IBM Security Privileged Identity Manager: Error Message Guide
Printed in USA
">