Login with VCF SSO and MS ADFS Configured using certificate authentication fails with "Access denied. Unable to authenticate the user"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Attempting to login with VCF SSO selected as the login method fails with an access denied error.

ADFS OIDC authentication is configured.

Smart card is used to authenticated to ADFS.

There is no identifier for "name" in the directory.

The vIDB service logs show errors similar to:

Exception occurred while retrieving oidc tokens com.vmware.vidm.federation.authenticator.oidc.OidcAuthen
ticationException: ID Token did not return expected nameId claim name

Cause

The identifier from OIDC ID token claim does not match the value from directory. 

Resolution

1. Configure an ADFS claim transform to map SAM-Account-Name to sAMAccountName.
   
2. Configure the Unique Identifier in OIDC Identity Provider configuration to use sAMAccountName.
3. Configure attribute mapping for userName to sAMAccountName