"Access Denied" When Logging into vIDM

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• When authentication is using with AD domain user and password, end-users may see an error message “Access Denied”.
• Administrators get "Access Denied" when trying to login into vIDM console either using AD domain or System domain.
• You receive error "400 bad request - invalid username / password" when using Aria Automation API to authenticate as a domain user
• Third-party SAML2 identity provider, and when attempt to authenticate with this provider receive an "Access Denied" message along with "Unable to authenticate the user."
  

Environment

• VMware Identity Manager 3.3.x

Cause

• This is usually an indication that either Access Policy is not set correctly, or Identity Provider is incorrectly set up.

Resolution

Option 1:

• If you get  "Access Denied" using Web browser: then in access policy, make sure you have Web Browser access policy, and first policy set as Password (cloud deployment) [outbound] or Password [inbound] or Certificate (cloud deployment). Also, one of the fallback methods should be Password (local directory).
• If you get "Access Denied" using anything other than Web browser: then in access policy, make sure you have first policy set as Password (cloud deployment) [outbound] or Password [inbound] or Certificate (cloud deployment) or Mobile SSO. Make sure none of the fallback is set to Password (local Directory) as other policies are designed for Active Directory users only and Password (local directory) cannot use AD credential to log in.

Option 2:

• Correct the default policy to "password" and fall back as "password local directory".
• Check if authAdapter is disable for any nodes.(note as a problematic connector). Go to Setup -> worker ID ->authAdapter -> passwrdIdpAdaptor
• Remove problematic connector from IDP  and re-add  them again to make authAdapter enabled. 

Option 3:

• Try create new policy for SAML IDP with SAML2Password with set as for any Device type and first authentication using with Password. Fallback is set to SAML2password and Password (local Directory) as other policies are designed for Active Directory users only, third-party SAML2 IDP and Password (local directory) to use AD credential to log in.
• Move the newly created policy at the top and check Login with  SAML identity provider.

Additional Information

• If the 'Access Denied' is encountered when working with a Microsoft Azure Entra ID Integration, validate the IDP and the access policy is correctly configured (and has no other conflicting policy configurations) as recommended in the KB: VMware Identity Manager(vIDM 3.3.x) on Azure Active Directory With JIT Provisioning
• Verify custom user attributes for the user - https://techdocs.broadcom.com/us/en/vmware-cis/other/vmware-identity-manager/3-3/vidm-admin-on-premise-master-map-3-3/about-local-directories/creating-a-local-directory/set-user-attributes-local-directory.html