vCenter login banner "An error occurred while fetching identity providers" due to multiple identity providers configured
search cancel

vCenter login banner "An error occurred while fetching identity providers" due to multiple identity providers configured

book

Article ID: 384996

calendar_today

Updated On:

Products

VMware vCenter Server VMware vCenter Server 7.0 VMware vCenter Server 8.0

Issue/Introduction

vCenter login page reports the following error "An error occurred while fetching identity providers. Please try again later. If problem persists, contact your administrator." 

vCenter websso logs under /var/log/vmware/sso directory 

YYYY-MM-DD HH:MM:SS ERROR websso[44:tomcat-http--6] [CorId=ec10e7a6-c8a5-476e-bf8b-9cb450e9857a] [com.vmware.identity.samlservice.i
mpl.ExternalIdpProvider] Exception while processing External login request : Multiple IDPs configured.

YYYY-MM-DD HH:MM:SS ERROR websso[44:tomcat-http--6] [CorId=ec10e7a6-c8a5-476e-bf8b-9cb450e9857a] [com.vmware.identity.SsoController
] Exception while processing external IDP request
com.vmware.identity.samlservice.ExtIdpNotFoundException: Exception while processing External login request
        at com.vmware.identity.samlservice.impl.ExternalIdpProvider.processDiscoveryRequest(ExternalIdpProvider.java:248) ~[libwebsso.ja
r:?]
        at com.vmware.identity.samlservice.impl.ExternalIdpProvider.processExternalIDPDiscoveryRequest(ExternalIdpProvider.java:93) ~[li
bwebsso.jar:?]
        at com.vmware.identity.SsoController.processExternalIDPRequest(SsoController.java:562) [libwebsso.jar:?]
        at com.vmware.identity.SsoController.sso(SsoController.java:131) [libwebsso.jar:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_412]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_412]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_412]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_412]
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) [spring-web-5.3.36.ja
r:5.3.36]
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150) [spring-web-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:903) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:809) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1072) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:965) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) [spring-webmvc-5.3.36.jar:5.3.36]
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898) [spring-webmvc-5.3.36.jar:5.3.36]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:529) [servlet-api.jar:4.0.FR]
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) [spring-webmvc-5.3.36.jar:5.3.36]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:623) [servlet-api.jar:4.0.FR]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:209) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.86]
        at com.vmware.tracing.TracingFilter.doFilter(TracingFilter.java:104) [wstClient.jar:?]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.86]
        at com.vmware.identity.SecurityRequestWrapperFilter.doFilterInternal(SecurityRequestWrapperFilter.java:49) [libwebsso.jar:?]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.36.jar:5.3.36]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.86]
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) [tomcat-websocket.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.86]
        at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:115) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.86]
        at com.vmware.identity.diagnostics.STSLogDiagnosticsFilter.doFilter(STSLogDiagnosticsFilter.java:84) [libvmware-identity-diagnostics.jar:?]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:178) [catalina.jar:9.0.86]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:153) [catalina.jar:9.0.86]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168) [catalina.jar:9.0.86]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) [catalina.jar:9.0.86]
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481) [catalina.jar:9.0.86]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130) [catalina.jar:9.0.86]
        at org.apache.catalina.valves.StuckThreadDetectionValve.invoke(StuckThreadDetectionValve.java:185) [catalina.jar:9.0.86]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) [catalina.jar:9.0.86]
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:670) [catalina.jar:9.0.86]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [catalina.jar:9.0.86]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:346) [catalina.jar:9.0.86]
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390) [tomcat-coyote.jar:9.0.86]
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) [tomcat-coyote.jar:9.0.86]
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:928) [tomcat-coyote.jar:9.0.86]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1794) [tomcat-coyote.jar:9.0.86]
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) [tomcat-coyote.jar:9.0.86]
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) [tomcat-util.jar:9.0.86]
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) [tomcat-util.jar:9.0.86]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) [tomcat-util.jar:9.0.86]
        at java.lang.Thread.run(Thread.java:750) [?:1.8.0_412]
Caused by: com.vmware.identity.samlservice.ExtIdpNotFoundException: Exception while processing External login request : Multiple IDPs configured.
        at com.vmware.identity.samlservice.impl.ExternalIdpProvider.processDiscoveryRequest(ExternalIdpProvider.java:219) ~[libwebsso.jar:?]
        ... 56 more

Environment

vCenter server 7.x 

vCenter server 8.x

Cause

Error occurs if both identity provider and federation are configured on the vCenter server at the same time. 

vCenter identity providers : 

  • IWA
  • LDAP/ LDAPs
  • OpenLDAP

vCenter identity federation : 

  • AD FS (vSphere 7.0 and later)
  • Okta (vSphere 8.0 Update 1 and later)
  • Microsoft Entra ID, formerly called Azure AD (vSphere 8.0 Update 2 and later)
  • PingFederate (starting in vSphere 8.0 Update 3)

Resolution

To address the issue, identify and remove any stale external identity providers or federation configurations as they cannot co-exist. 

  • Create a fresh snapshot of the vCenter server. If the vCenter is part of an Enhanced Linked Mode (ELM) configuration, ensure that offline snapshots are taken for all vCenters within the ELM setup.
  • Connect to the vCenter server using Jxplorer. Follow How to export VMDir information from vCenter Server using the JXplorer utility.
  • Next, navigate to the specified path in JXplorer, as shown below. You can also refer to the screenshot provided for guidance.
    • vsphere => Services => IdentityManager => Tenants => vsphere.local (or any custom domain ) 
    • Examine the below and remove the stale property under : 
        • IdentityProviders (identity Providers) 
        • VCIdentityProviders (Identity Federation) 
  • For example, 
        • If the goal is to use AD over LDAP, all (four) objects under "VCIdentityProviders" must be deleted manually
        • or
        • If the goal is to useMS Entra ID, remove the object under IdentityProviders

Caution : vsphere.local (or any local domain) and localos must not be deleted. Consult Broadcom support if in doubt. 

  • The changes would be effective immediately. In a vCenter with ELM configuration and "Normal" state of vmdird the changes should reflect in 30 seconds.
Powered by Wolken Software