---
title: Troubleshooting the Consent Service
description: This section provides general guidelines for troubleshooting the Consent Service and any connection issues.
component: pingdirectory
version: 11.0
page_id: pingdirectory:consent_solution_guide:pd_cs_troubleshoot_consent_service
canonical_url: https://docs.pingidentity.com/pingdirectory/11.0/consent_solution_guide/pd_cs_troubleshoot_consent_service.html
revdate: September 13, 2023
---

# Troubleshooting the Consent Service

This section provides general guidelines for troubleshooting the Consent Service and any connection issues.

When evaluating the configuration:

* Make sure that the Consent Service is enabled.

* Make sure that the Consent Service base distinguished name (DN) exists.

* Make sure that the Consent Service's service account has the correct permissions.

* If the Consent Service should accept bearer tokens, make sure that:

  * One or more access token *(tooltip: \<div class="paragraph">
    \<p>A data object by which a client authenticates to a resource server and lays claim to authorizations for accessing particular resources.\</p>
    \</div>)* validators are configured correctly.

  * The identity mappers for the access token validators are configured correctly.

  * The authorization servers are configured correctly to issue tokens that the Consent Service can accept. Check the `audience`, `privileged-consent-scope`, and `unprivileged-consent-scope` properties of the Consent Service configuration.

* If privileged users are defined, make sure that the members of the Lightweight Directory Access Protocol (LDAP) *(tooltip: \<div class="paragraph">
  \<p>An open, cross platform protocol used for interacting with directory services.\</p>
  \</div>)* group are specified by the Consent Service configuration's `privileged-users-group-dn` property.

* If there are applications that allow individuals to manage their own consents, make sure that the system is properly configured to map `actor` and `subject` DNs. Check the Consent Service configuration's `consent-record-identity-mapper` property.