vSphere Authenticated Aria Orchestrator 8.18.x fails to login with Error ${message}

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• VMware Aria Orchestrator 8.18.x fails to login. The user is redirected to a blue screen displaying the following error: ${message} ${backtoLoginLabel}
  

Environment

• VMware Aria Automation Orchestrator 8.18.x

Cause

This issue typically occurs due to:

1. 1. Password Change: The vSphere authentication administrator account password (e.g., [email protected]) was recently changed, and Orchestrator retains the old credentials.
   2. Time Drift: Synchronization mismatch between the vRO cluster nodes and the authentication endpoint (vCenter/NTP), resulting in token expiration errors.

Resolution

1. Validate Time Synchronization Before reconfiguring authentication, check for time drift which can cause SAML token failures.

1. Review logs for time-related errors: 
   

   grep -i "is not after startTime" /data/vco/usr/lib/vco/app-server/conf/vco-server-app.log

2. Verify NTP status on all nodes, and ensure time matches across the cluster nodes and the authentication endpoint.
   1. you can check the Orchestrator cluster nodes NTP details with:

      vracli ntp status

3. You can review this documentation link for more details on synchronizing time with an ESXi endpoint.

2. Reconfigure vSphere Authentication If time is synchronized, proceed with re-registering authentication:

1. Log in to the Aria Orchestrator appliance as root via SSH.
2. Retrieve the current configuration: vracli vro authentication
3. Unregister the current vSphere Authentication:

   vracli vro authentication unregister -u

4. Re-register the vSphere Authentication using the wizard:

   vracli vro authentication wizard

5. If the issue persists, rebuild the orchestrator pods:

   kubectl delete pods -n prelude --select=app=vco-app

Additional Information

For further context, refer to How to Configure the Automation Orchestrator Appliance authentication provider on 8.18.x.

To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.

Configuring the Automation Orchestrator Appliance authentication provider with the command line interface