This article is to help point out a possible failure during smart card authentication that has been seen to occur when there is a trailing space that causes the parsing of the certificate to fail in the authentication process.
Symptoms:
websso.log may show errors similar to:
2022-05-09T08:30:45.938Z ERROR websso[85:tomcat-http--33] [CorId=########-####-####-####-##########4b] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.idm.IDMException: Unable to match an account with certficate SAN extension!' ... Caused by: com.vmware.identity.idm.IdmClientCertificateParsingException: Empty Subject Alternative Names ...
vmware-sts-identity.log may show errors similar to:
2022-05-09T08:30:45.938Z INFO sts[84:tomcat-http--33] [CorId=########-####-####-####-##########3c] [com.vmware.identity.idm.server.IdentityManager] Authentication failed for user [username#] in tenant [vsphere.local] in [39] milliseconds with provider [xxxxx.xxx] of type [com.vmware.identity.idm.server.provider.ldap.LdapWithAdMappingsProvider] 2022-05-09T08:30:45.938Z ERROR sts[84:tomcat-http--33] [CorId=########-####-####-####-##########3c] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.idm.IDMLoginException: Login failed' com.vmware.identity.idm.IDMLoginException: Login failed 2022-05-09T08:30:45.942Z INFO sts[84:tomcat-http--33] [CorId=########-####-####-####-##########3c] [com.vmware.identity.sts.InvalidCredentialsException] Censored exception com.vmware.identity.sts.InvalidCredentialsException: IDM rejected authentication by UPN
The UPN of the user appears to match an entry in the SAN of the certificate.
The /var/log/vmware/sso/websso.log shows messages that indicate the subject alternative name expected to match ends in space:
2022-05-09T08:30:45.938Z INFO websso[95:tomcat-http--33] [CorId=########-####-####-####-##########4b] [com.vmware.identity.idm.server.clientcert.IdmCertificatePathValidator] Validating certificate path for [CN...] ... Unparseable certificate extensions: 1 [1]: ObjectId: 3.3.33.33 Criticality=false Unparseable SubjectAlternativeName extension due to java.io.IOException: invalid URI name:urn:uuid:some-uuid-in-thetext 000000 74 68 69 73 69 73 6a 75 73 74 65 78 61 6d 70 6c thisisjustexampl 000010 65 68 65 78 73 6f 6d 65 75 70 6e 40 73 6f 6d 65 ehexsomeupn@ 000020 65 78 61 6d 70 6c 65 2e 63 6f 6d 2e 2e 2e 2e 2e example.com..... 000030 2e 2e 2e 2e 2e 2e 2e 73 65 63 6f 6e 64 65 6e 74 .......secondent 000040 72 79 75 72 6e 3a 75 75 69 64 3a 73 6f 6d 65 2d ryurn:uuid:some- 000050 75 75 69 64 2d 69 6e 2d 74 68 65 74 65 78 74 20 uuid-in-thetext ...