OKTA Configuration Fails with : http://localhost:1080/external-vecs/http2/<vCenter-FQDN>/443/trustmanagement invocation failed with java.net.SocketTimeoutException"

Products

• VMware vCenter Server

Issue/Introduction

• While configuring Identity Provider in the vCenter, it will fail with
  Error: http://localhost:1080/external-vecs/http2/<vCenter-FQDN>/443/trustmanagement invocation failed with java.net.SocketTimeoutException: 6000,000 milliseconds timeout on connection http-outgoing-98 [ACTIVE]

       

Cause

The Redirect URL includes the hostname or FQDN of the vCenter .If there's a PNID (Primary Network Identifier) and FQDN mismatch, this URL may point to the wrong endpoint, causing auth failures.

• Confirm that the difference between the two values with the following commands from an SSH session to the vCenter Appliance:
  
  
• • To verify the current PNID, run the following command:

                   /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost

• • To verify the Current Hostname, run the following command:
    
    hostname

Resolution

To change the Hostname of the vCenter, follow the below steps:

1. Take a snapshot of the vCenter. If the nodes are in Enhanced Linked Mode, power off all vCenters before taking the snapshot.

2. Retrieve the PNID value by running the following command via SSH:

   /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost

3. Run the VAMI network configuration tool:

   /opt/vmware/share/vami/vami_config_net

   • Select option 3 ("hostname") and input the PNID obtained in step 2.

4. Restart your vCenter by running the following command:

Reboot -f

     5. Reset all certificates by referring Regenerate vSphere certificates using VMCA or Replace vCenter Machine SSL using custom certificate if your Machine SSL certificate is a custom Signed certificate.

 

Once the above steps are completed, reconfigure Identity Provider on your vCenter.

Additional Information

The same error was also observed during the configuration of the Entra identity provider.