When trying to log in to Aria products using vIDM and an external Identity Provider we get "Error Incorrect issuer in SAML AuthnRequest."

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• While logging into any product using vIDM you may receive the error 'Error Incorrect issuer in SAML AuthnRequest.'
• In a clustered environment, you may receive the above error one in every three attempts.
• vIDM health is reported as Green in Aria Lifecycle and in the vIDM admin UI.

Environment

VMware Identity Manager 3.3.7

VMware Aria Suite

Cause

 

The 'config-state.json' file has an incorrect entry for the mol URL on one or more nodes. It does not contain the cluster load-balanced **FQDN** with the port.

This is an example of what should be present:

https://<vIDM_LB_FQDN>:443/SAAS/t/Tenant_Name

 

Resolution

The 'config-state.json' file needs to be updated with the correct values.

1. Take **snapshots** of all nodes, without memory.
2. Navigate to '/usr/local/horizon/config/states/TENANT_NAME/####/' on all nodes.
   • The Tenant name and #### will vary.
3. Open the current 'config-state.json' using 'vi'.

   • vi config-state.json

4. Determine which nodes have the incorrect value for the **URL** by comparing the 'mol' section of the config, which is at the beginning of the file on line 6. See an example of the correct format below:

   • "url" : "https://<vIDM_LB_FQDN>:443/SAAS/t/Tenant_name/",

5. Stop the 'horizon-workspace' service.

   • service horizon-workspace stop

6. Update the 'config-state.json' file so that the 'url' matches the format in the example above. It can be copied from a node where the format is correct. Save and quit.
7. Restart the 'horizon-workspace' services.

   • service horizon-workspace start

8. Allow some time for the services to come back up fully and test the logins again.

Additional Information

The configured **URL** in the 'mol' section of the 'config-state.json' may be the node's own **FQDN** without the port, as per the example below.

"url" : "https://<vIDM_NODE_FQDN>/SAAS/t/Tenant_name/",