Troubleshoot the connector

ploy-connector doctor checks the whole connector setup and prints a PASS, WARN, or FAIL result for each check, with a suggested fix under anything that is not a PASS. It is read-only: it never changes your systems or the connector's existing state, and its output is safe to send to Ploy support. Doctor is available from connector version 0.5.2.

What doctor checks

Doctor runs four groups of checks, in this order:

• Config and environment: the config file loads and is valid, the CA bundle, that the state directory is writable, and free disk space.

• Backend: DNS, the proxy, that the connector can reach Ploy and its bearer key is accepted, and that the clock is within 5 minutes of Ploy's.

• Integration, once per configured integration: checks specific to that integration. The Active Directory checks are described below.

• State: whether the connector has task results it has not been able to report to Ploy.

Run doctor

Run doctor on the connector host itself.

On Windows

From an elevated PowerShell (Run as administrator):

cd "C:\Program Files\Ploy\Connector"
.\ploy-connector.exe doctor

Running it elevated matters. Doctor runs its checks as the connector service's account, so the results describe what the service can actually do. To do that it registers a temporary service called PloyConnectorDoctor under that account, runs once, and removes it. The first line of the report names the account the checks ran as, for example running as — CORP\ploy-connector$.

If you run doctor unelevated, it checks as your current user account and warns that the results describe that user, not the connector service. Re-run it from an elevated prompt.

On Linux

Run ploy-connector doctor. The binary is installed at /usr/local/bin/ploy-connector.

Options

• -report doctor.txt writes the report to a file you can send to Ploy support.

• -offline skips all network checks.

Active Directory checks

For the Active Directory connector, the integration checks cover the LDAPS certificate chain (if a certificate is expired, untrusted, or does not match the DC hostname, doctor names which certificate and why), the connection and authentication to the DC, which account it authenticates as, whether that account may create users in the OU new users go into, and whether it can write the attributes Ploy sets on users there. For setup and permissions, see Set up the Active Directory connector.

By default doctor checks the default create OU set in Ploy, or base_dn if none is set. To check a specific OU instead, such as one a Create-user step in a flow names, pass it with -setting:

.\ploy-connector.exe doctor -setting "default_create_ou=OU=Staff,DC=corp,DC=example,DC=com"

Fix common AD findings

Each non-PASS result names the failed check and a suggested fix. Match yours below.