vSphere UI will not be accessible through NAT IP of VCSA

Products

• VMware vCenter Server
• VMware vCenter Server 7.0
• VMware vCenter Server 6.0

Issue/Introduction

Symptoms:

• Verified from the vSphere UI that the authentication request is rejected. The UI displays the following error message during access:
  "[400] An error occurred while sending an authentication request to the vCenter Single Sign-On server - An error occurred when processing metadata during vCenter Single Sign-On setup: the service provider validation failed. Verify that the server URL is correct and is in FQDN format, or that the hostname is a trusted service provider alias."
• In /var/log/vmware/vsphere-ui/vsphere_client_virgo.log, we will see following error message
  [YYYY-MM-DDTHH:MM:SS.###Z] [ERROR] http-nio-####-exec-# ######## ###### ###### com.vmware.vsphere.client.security.websso.MetadataGeneratorImpl Failed to process WebSSO metadata java.lang.IllegalArgumentException: Invalid SP alias.

Environment

VMware vCenter Server 6.7.x
VMware vCenter Server 7.x
VMware vCenter Server 8.x

Cause

The issue occurs when the Vsphere UI Client is accessed by a client through a non-transparent network intermediary, such as NAT. In this case the server name part of the request is the address of the intermediary, which cannot be registered as a service provider alias in SSO. Consequently, all login attempts, except those made by accessing Vsphere UI by FQDN fails because service provider registration is rejected. This was originally done for security reasons. However, there might be real-world deployment scenarios where a VCenter is part of a private network and its IP address is not visible from outside.

Resolution

To resolve the issue,

1. SSH to the VC machine and edit /etc/vmware/vsphere-ui/webclient.properties.
2. Look for the property named sso.serviceprovider.alias.whitelist.
3. Remove the comment from the property and add the IP address of the NAT router
   ​​​​​​​sso.serviceprovider.alias.whitelist=<NAT-router-IP>.
4. Restart the H5 client service.