On a Windows 2012 R2 server, with Java 8, Identity Connect occasionally throws the following exceptions the first time it is started:

March 09, 2016 4:07:12 ODP. org.eclipse.jetty.util.log.JavaUtilLog warn
WARNING: 1 threads could not be stopped
March 09, 2016 4:07:12 ODP. org.forgerock.openidm.logging.LogServiceTracker logEntry
SEVERE: Bundle: org.forgerock.openidm.servlet [80] [org.forgerock.openidm.ui.context]
      Cannot create component instance due to failure to bind reference webContainer
March 09, 2016 4:07:12 ODP. org.forgerock.openidm.logging.LogServiceTracker logEntry
SEVERE: Bundle: org.forgerock.openidm.servlet [80] [org.forgerock.openidm.ui.context]
      Component instance could not be created, activation failed
...     

Restarting Identity Connect resolves the problem.

When mapping a custom SalesForce user attribute with multiple values, the group autocomplete window appears with the wrong focus.

Occasionally, an updated Permission Set to AD group mapping or Salesforce group to AD group mapping does not display immediately. When the browser is refreshed, the updated configuration is displayed.

When a public group is deleted in Salesforce, the deletion of that group is not reflected immediately in the Admin UI, and still displays in mappings until the browser is refreshed.

The OrientDB database backup feature is not working as expected.

Identity Connect throws exceptions the first time it is started.

There are hard-coded references to database schema and table names in the JDBC configuration file for MySQL.

For an Active Directory LDS server, the pwdLastSet attribute is not visible on the Mapping page, and is therefore not able to be mapped.

When multiple Salesforce organizations are configured, updating the Salesforce Connector configuration incorrectly returns administrators to the Create / Clone Organization page.

In certain situations, the LiveSync scheduler for Active Directory groups is not enabled during the Identity Connect configuration.

Value Precedence for Profile mappings is not working correctly for LiveSync operations.

The WARNING message Unexpected failure during source reconciliation should provide more information on what has caused the problem.

During configuration, a large number of messages are logged at WARNING level, when in fact they are harmless and can be ignored.

Starting Identity Connect as a windows service occasionally fails on a Windows 2012R2 server.

The progress status for a reconciliation operation triggered by "Synch Now" is no longer displayed after a user logs out and logs back in.

When Identity Connect is configured in a cluster with persisted schedules configured on multiple nodes, it is possible for one node to 'steal' the trigger from under another node. When this happens the exception is logged as SEVERE. In fact, this exception is harmless and should be logged at the INFO level or hidden.

When the Salesforce access token expires and is silently refreshed by Identity Connect the following messages are logged as SEVERE:

Jul 16, 2014 4:37:40 PM org.restlet.engine.security.AuthenticatorUtils parseRequest
  WARNING: Couldn't find any helper support the HTTP_Token challenge scheme.
Jul 16, 2014 4:37:40 PM org.forgerock.openidm.salesforce.internal.SalesforceConnection
  getJsonResourceException
  SEVERE: REST API error:[ { "message" : "Session expired or invalid", "errorCode" :
  "INVALID_SESSION_ID" } ]
Jul 16, 2014 4:37:40 PM org.forgerock.openidm.salesforce.internal.SalesforceConnection
  getJsonResourceException
  SEVERE: Remote REST error: { "error": 401, "reason": "Unauthorized", "message":
  "Unauthorized", "detail": { "message": "Session expired or invalid",
  "INVALID_SESSION_ID": { "message": "Session expired or invalid", "errorCode":
  "INVALID_SESSION_ID" } } }

In addition a number of WARNING level connection reset messages are also logged to the IC log:

Jul 16, 2014 4:37:41 PM org.restlet.engine.http.connector.Connection writeMessage
  WARNING: Exception while writing the message headers. java.net.SocketException:
  Connection reset

These messages should be hidden as they are harmless, and their inclusion in the logs is confusing.

When a CA-signed certificate is uploaded into Identity Connect by using the UI, Identity Connect must be restarted for the new certificate to be taken into account.

In a clustered environment, with an OrientDB repository, if the primary node is down, the user login screen is not available.

When Identity Connect was configured on a Windows Server, with Internet Explorer 11, a CA certificate added via the UI was not saved.

When a base context is changed in the Active Directory data source, Identity Connect does not update the mappings accordingly.

There is currently no way to refresh permission set license agreements from within the Identity Connect user interface. The current refresh rate is every hour.

If the data source type is changed from Active Directory to AD LDS, reconciliation fails.

The liveSync mechanism does not synchronize user changes in a subdomain after a change from domain controller (DC) mode to global catalog (GC) mode.

Identity Connect can be installed as a Windows service only as the administrator, rather than as any user with administrative privileges.

In a clustered environment, with an OrientDB repository, when the primary node is restarted login fails on the secondary nodes. Restarting the secondary nodes solves the problem.

When the connection to Salesforce.com is lost (due to a network outage, for example) the message that is displayed in the UI ("unknown error") does not indicate the problem.

Failure to synchronize when the maximum number of APIs is reached is not reported in the UI. Instead, a partial list of users is retrieved. The error messages are, however, output to the logs.

HTTP endpoints should automatically be redirected to https and root endpoints should be redirected to https://host.domain:8443/connect.

With Internet Explorer 9, an error in the Active Directory connector configuration can cause the browser to hang during the connector validation process, with no error displayed.

Certain attributes that are not replicated to the global catalog, are still displayed by the UI when port 3268 or 3269 is used.