Error: Unable to process login when authenticating with external vIDB SSO - VCF Operations for Networks

Products

• VCF Operations for Networks

Issue/Introduction

Users encounter a login failure when attempting to authenticate to Operations for Networks using an external VMware Cloud Foundation Operations Identity Broker (vIDB) integrated with Active Directory (AD) over LDAPS.

• The UI displays the error: "Unable to process login. Please contact support team."
• Authentication works successfully for other integrated components (vCenter, NSX, VCF Operations, Operations for Logs).
• The vIDB cluster is integrated with AD over LDAPS with provisioned groups.

Environment

• VCF Operations for Networks 9.0
• VMware Cloud Foundation Operations Identity Broker 9.X

Cause

The issue is caused by incorrect attribute mappings for Active Directory within the OIDC configuration.
Specifically, the attributes required by Operations for Networks to identify the user or group memberships do not match the attributes provided by the Identity Broker.

Resolution

To resolve this issue, verify and correct the attribute mappings in the Identity Broker and VCF Operations for Networks configuration:

1. Log in to the VMware Cloud Foundation Operations Identity Broker administration console.
2. Navigate to the Identity Provider settings for the Active Directory integration.
3. Verify the Attribute Mappings (e.g., sAMAccountName, userPrincipalName, memberOf).
4. Ensure that the specific OIDC client created for Operations for Networks is configured to release these claims.
5. Log in to the VCF Operations for Networks UI as a local administrator.
6. Navigate to Settings > Settings > Identity Management.
7. Update the attribute mappings to match the values provided by vIDB.
8. Test the login using an AD account.

Additional Information

• For guidance on creating and managing Broadcom support cases. 
• To speak with a customer representative or a Support Engineer, see Contact Support.