Unable to login to VCF Automation using AD user. It fails with error: "Your Single Sign-On attempt failed"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Configurations:
  • VCF Automation has been configured to use VCF SSO for authentication, as per Configure Your System to Use an OpenID Connect Identity Provider Using Your VCF Automation Provider Management Portal
  • Users / Groups were imported into the access control of VCFA as per: Managing VCF Automation Provider Users and Groups
• However, all attempts to log in to VCF Automation using the VCF SSO result in the following error: "Your Single Sign-On attempt failed"
• The /var/log/services-logs/prelude/tenant-manager-0/file-logs/vcloud-container-debug.log show the following errors:
  | DEBUG   | pool-jetty-449659           | OrgMemberProvider                         | Neither user <username>@<domain> nor any of the groups [<groupname>@<domain>] of type OAuth are imported to org <orgId> | requestId=<requestId>,request=GET https://<vcfa_fqdn>/login/oauth,requestTime=<time>,remoteAddress=ip_address:port,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=text/html application/xhtml+xml application/xml;q 0.9 image/avif image/webp image/apng */*;q 0.8 application/signed-exchange;...,Host=<vcfa_fqdn>
| WARN    | pool-jetty-449659           | OAuthAuthenticationSuccessHandler         | Error logging in user <user_id> | requestId=<request_id>,request=GET https://<vcfa_fqdn>/login/oauth,requestTime=timestamp,remoteAddress=ip_address:port,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=text/html application/xhtml+xml application/xml;q 0.9 image/avif image/webp image/apng */*;q 0.8 application/signed-exchange;...,Host=<vcfa_fqdn>
• The same users are able to login to VCF Operations and other integrations using VCF SSO. 

Environment

• VCF Automation 9.0.x

Cause

• The issue is caused due to incorrect UPN format added while importing user/group.
• VCF Automation lookup, expects the user and groups to be imported using UPN format.

Resolution

1. Log in to the VCF provider Portal
   Use an account with administrative privileges.
2. Navigate to the Access control Section
   • Go to Administration > Access control
3. Import Group / User:
   • Import Group:
     • Select Import Group.
     • Select VCF SSO
     • In the group name field, enter the UPN format:
       groupname@domain
   • (Optional) Import User :
     • Select Import User.
     • Select VCF SSO
     • In the username field, enter the UPN format:
       username@domain  
4. Assign Role to Group / User
   • After adding the user or group, assign the appropriate role based on required access level
   • Save the changes.
5. Log Out of the Current Session
6. Log In Using VCF SSO as the Newly Added User
   • Use the same UPN credentials to log in via VCF SSO.
   • Confirm that the assigned role permissions are active.

Note: The above steps apply to both users and groups. Ensure that the group names are also provided in the correct UPN format (groupname@domain) and assigned suitable roles during import.