Error 1000 on IWA Agent Install

During the installation of the Desktop Single Sign-On (SSO) Integrated Windows Authentication (IWA) agent, an error may occur when attempting to validate the Active Directory (AD) Service Account. This prevents the installer from proceeding or retrying the Service Account entry.

Unable to verify the service account. Error code: 1000 

 

• Directories
• Desktop Single Sign-On (DSSO)
• Integrated Windows Authentication (IWA) agent
• Okta Classic Engine

This issue typically arises if the IWA installer is directed to a Service Account (User) with an improperly configured User Principal Name (UPN) Suffix. If the installer targets a User Object with a UPN Suffix that the Domain Controller cannot authenticate, the installation fails. The Domain Controller requires a properly configured Cross Forest Trust (for redirecting domain lookups) or an added UPN Suffix in the domain that corresponds to the User Object.

This error can be identified in the installer logs, which are located in the temp directory: %Temp%. The log file will have a name similar to OktaSsoIwa-20181105T154018-Install.

Example log entries:

00072019|TSU:I0026|0409-01D47547B87707EA|Searching for existing Okta service account...
00072029|TSU:I0042|0409-01D47547B87707EA|C:\inetpub\wwwroot\IWA\tools\iwa-service-setup.exe|--verifySvcUser OktaService@notreal.com|C:\inetpub\wwwroot\IWA\tools
0007202A|TSU:I0043|0409-01D47547B8775609|C:\inetpub\wwwroot\IWA\tools\iwa-service-setup.exe|--verifySvcUser OktaService@notreal.com|00000300
0007202B|TSU:I0044|0409-01D47547B8775609|C:\inetpub\wwwroot\IWA\tools\iwa-service-setup.exe|--verifySvcUser OktaService@notreal.com|00000300
00070005|TSU:D0006|0409-01D47547B8ACBECA|LastExitCode|0|1000
0007202C|TSU:I0045|0409-01D47547B8ACBECA|C:\inetpub\wwwroot\IWA\tools\iwa-service-setup.exe|--verifySvcUser OktaService@notreal.com|1000
00072020|TSU:I0033|0409-01D47547B8ACE5D7|FindExistingSvcUser|0
00070019|TSU:D0026|0409-01D47547B8ACE5D7|FindExistingSvcUserError|LastExitCode <> 0 AND LastExitCode <> 20|1
00072008|TSU:I0009|0409-01D47547B8ACE5D7|FindExistingSvcUserError|Unable to verify the service account. Error code: 1000
0007200C|TSU:I0013|0409-01D47547C2E8FFE0|Unable to verify the service account. Error code: 1000|30000010|1
0007A019|TSU:W0026|0409-01D47547C2E8FFE0|80000000|1|1

The solution to this issue involves utilizing a Service Account with a properly configured UPN Suffix. Consider the following guidelines when configuring a UPN Suffix:

1. If a UPN Suffix is not appended to the username for the AD Service Account, the installer will assume that the Account exists in the local AD and add the Domain where the IWA Agent is being installed.

2. If an attempt is made to append the UPN Suffix manually, the Installer must be able to validate the User against the AD Domain that owns that UPN. This validation can be achieved either through a UPN Suffix added to the Domain or via a Cross Forest Trust established between the Local and Foreign AD Domain. If the Installer cannot validate against the domain that is manually added to the UPN for the Service Account, it will fail with the error code 1000.