Users previously able to access TMC fail when attempting to reonboard. No email sent to user.

Products

• VMware Tanzu Mission Control

Issue/Introduction

• Users in TMC who have been added in the past might not receive an email when re-onboarded to TMC when Identity Management is Federated from a local Active Directory source.
• This has been seen in environments where user's API Token expired. In an attempt to recover the user, they were removed from TMC and added back to TMC.
• The invitation email is not sent to the user when attempting to re-onboard, instead, they are immediately added to the Active Users field and don't need to accept an invitation email.
• Subsequently they were unable to perform normal TMC operations.

Cause

As the user is added immediately to the Active Users field, they don't need to confirm or activate their account via an invitation email. Cached tokens on the local user's browser might need to be cleared to prevent TMC operation failures after the user is re-onboarded.

Resolution

If the user, after logging in, is unable to access services in TMC, clear the browser cache or use Incognito mode to access TMC with stateless browser caching. This should allow the user to re-authenticate and update their browser with a new token.