VCO SSO login not working due to error "invalid_client...: The provided client keys...are expired. Visit the Azure portal to create new keys for your app.."

Products

• VMware VeloCloud SD-WAN

Issue/Introduction

Customer level users are unable to login via SSO to VCO due to error  "invalid_client...: The provided client keys...are expired. Visit the Azure portal to create new keys for your app.."

Environment

VMware SDWAN Orchestrator - All VCO versions are affected

Cause

The Azure client secret key on Azure side has expired

Resolution

To fix the error "invalid_client" with error code "AADSTS7000222," indicating that the client secret keys for your app are expired, follow these steps:

Steps to Resolve the Expired Client Secret

1. Log in to the Azure Portal:

• Navigate to https://portal.azure.com and log in with your credentials.

2. Locate Your App Registration:

• In the left-hand menu, select "Azure Active Directory."
• Under "Manage," select "App registrations."
• Find and select the app registration corresponding to the app ID 'f852a5e0-c1fc-4883-a25e-170c0816a410'.

3. Add a New Client Secret:

• Under "Manage," select "Certificates & secrets."
• In the "Client secrets" section, click "New client secret."
• Add a description for the new client secret (e.g., "New client secret").
• Choose an expiration period for the secret (e.g., 1 year, 2 years).
• Click "Add."

4. Update Your Application with the New Client Secret:

• After creating the new client secret, copy the value displayed. This value will only be displayed once, so ensure you store it securely.
• Update your application's configuration with the new client secret value.

Steps 1-3 has to be performed in the Azure website (Please contact Azure Support for any queries on Step 1-3) and the Step-4 has to be performed on the VCO SSO configuration and below is the snapshot. 

To be specific below Client Secret key needs to be updated.