---
title: Remote proxy troubleshooting
description: Troubleshoot common PingIDM remote proxy issues including 401, 403, 404, and SSL errors, with a testing checklist
component: pingidm
version: 8.1
page_id: pingidm:objects-guide:remote-proxy-troubleshooting
canonical_url: https://docs.pingidentity.com/pingidm/8.1/objects-guide/remote-proxy-troubleshooting.html
llms_txt: https://docs.pingidentity.com/pingidm/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Data Object Model", "Synchronization"]
section_ids:
  remote-proxy-401: OAuth 2.0 authentication fails
  remote-proxy-403: Forbidden access
  remote-proxy-404: Proxy not found
  remote-proxy-ssl-errors: SSL/TLS certificate errors
  remote-proxy-testing-checklist: Testing checklist
---

# Remote proxy troubleshooting

These troubleshooting topics and a testing checklist address common remote proxy issues:

* [OAuth 2.0 authentication fails](#remote-proxy-401)

* [Forbidden access](#remote-proxy-403)

* [Proxy not found](#remote-proxy-404)

* [SSL/TLS certificate errors](#remote-proxy-ssl-errors)

* [Testing checklist](#remote-proxy-testing-checklist)

## OAuth 2.0 authentication fails

**Symptom**: 401 Unauthorized when accessing the proxy.

* Verify the OAuth 2.0 client exists on the remote instance.

* Check that `clientId` and `clientSecret` match the OAuth 2.0 client credentials on the remote instance.

* Ensure the OAuth 2.0 client has the `client_credentials` grant type.

* Verify `tokenEndpointAuthMethod` is `client_secret_post`.

* Check that the OAuth 2.0 client has the `fr:idm:*` scope.

## Forbidden access

**Symptom**: 403 Forbidden when querying data.

* Verify the static user mapping is configured.

* Check that `subject` in the static user mapping matches the OAuth 2.0 `clientId`.

* Ensure roles include the role configured in the static user mapping (for example, `internal/role/platform-provisioning`).

## Proxy not found

**Symptom**: 404 Not Found when accessing `/openidm/external/idm/<remote-instance-name>`.

* Check that the config was created: `GET /openidm/config/external.idm/<remote-instance-name>`.

* Verify the config name matches the proxy name formatting (for example, dot form in config path, slash form in access path).

* Ensure `enabled` is `true` in the configuration.

## SSL/TLS certificate errors

**Symptom**: SSL handshake failures.

* Import the remote instance's certificate into the local instance's truststore.

* Verify the certificate is valid and not expired.

* Check network connectivity and firewall rules.

## Testing checklist

Before reporting a connectivity issue, verify the following:

* OAuth 2.0 client is created on the remote instance.

* OAuth 2.0 client has the `client_credentials` grant.

* OAuth 2.0 client has the `fr:idm:*` scope.

* `tokenEndpointAuthMethod` is `client_secret_post`.

* Static user mapping is configured on the remote instance.

* Static user mapping `subject` matches the OAuth 2.0 client ID.

* External IDM config is created on the local instance.

* Config `clientId` and `clientSecret` match the OAuth 2.0 client.

* Config `tokenEndpoint` points to the correct realm.

* Config `instanceUrl` ends with `/openidm/`.

* Proxy query succeeds: `GET /openidm/external/idm/<remote-instance-name>/managed/user`.