VCO - SSO remote login will fail with error "invalid_client"

Products

• VMware VeloCloud SD-WAN

Issue/Introduction

When remote users login to the VCO who were configured via OIDC VCO will fail to login to the VCO with the error ""error":"invalid_client","error_description":"XXXXX An invalid client assertion or client secret was provided for the client identifier.","name":"OPError"".

 

Environment

Velocloud Orchestrator Any version. 

Cause

When users notice this error, they will not be able to authenticate against the VCO. The logs indicate that the login failure is due to incorrect client credentials (invalid_client) provided during the SSO process. The VCO cannot validate the SSO session, leading to a failure in creating a user session. This is because of the expired password in OIDC.

Resolution

This error (""error":"invalid_client","error_description":"XXXXXX An invalid client assertion or client secret was provided for the client identifier.","name":"OPError"".) will be seen when the password is expired on the OpenId connect SSO. We need to reset the password for the SSO vendor to fix the problem. 
 
Important Notes:

• The specific URL for the SSO login page (Ex - oidc.idp.login) and the appearance of the password reset option may differ depending on your organization's setup.
• Some organizations may enforce multi-factor authentication (MFA), so you may need to complete an additional verification step.