Frequent Pinniped Authentication Prompts Every ~2 Minutes When Using ADFS as External Identity Provider with Tanzu Supervisor

search cancel

Frequent Pinniped Authentication Prompts Every ~2 Minutes When Using ADFS as External Identity Provider with Tanzu Supervisor

book

Article ID: 412874

calendar_today

Updated On:

Products

VMware vSphere Kubernetes Service

Issue/Introduction

In environments using vCenter federated with Microsoft ADFS as an external IDP for the latest vSphere Supervisor releases, repeated authentication prompts occur when logging in through the Tanzu CLI with Pinniped. Authentication works initially, but after approximately two minutes of idle time the user is prompted again to re-authenticate. This cycle repeats consistently, impacting normal workflow.

Environment

vSphere Supervisor 8.0
vSphere Supervisor 9.0
vCenter federated with Microsoft ADFS as an external IDP

Cause

The short session timeout is due to the lifetime of Pinniped-issued tokens, which is not configurable in the latest vSphere Supervisor releases.
In addition, ADFS does not fully implement the OIDC specification, leading to refresh token errors.

Resolution

There is no supported configuration change with the old releases of Pinniped ( < v0.41.0) to extend the session lifetime.
A workaround requires a Supervisor update that includes Pinniped v0.41.0 or later, along with updated configuration for ADFS integration.
Manual upgrades of Pinniped pods are NOT supported and are NOT recommended.

This workaround will be available with vSphere 8.0U3P07 or higher which will include Pinniped v0.41.0.

If the included Pinniped version is 0.41.0, you can implement following workaround:

0. Check & confirm current Pinniped version is 0.41.0 from Superviso
kubectl describe deploy pinniped-supervisor -n vmware-system-pinniped | grep Image:

1. Back up current pinniped-supervisor-static-config configmap.

kubectl get cm -n vmware-system-pinniped pinniped-supervisor-static-config -o yaml > pinniped-supervisor-static-config.yaml

2. Edit the pinniped-supervisor-static-config configmap and edit the ADFS UserInfoEndpoint

kubectl edit cm -n vmware-system-pinniped pinniped-supervisor-static-config

apiVersion: v1
data:
pinniped.yaml: |
apiGroupSuffix: pinniped.dev
names:
defaultTLSCertificateSecret: pinniped-supervisor-default-tls-certificate
apiService: pinniped-supervisor-api
labels:
app: pinniped-supervisor
.....
log:
level: debug
oidc: #<+
ignoreUserInfoEndpoint: #<+
whenIssuerExactlyMatches: #<+
- "https://login.your-adfs.domain/adfs" #<+ Add this oidc section with your own ADFS UserInfo endpoint.
kind: ConfigMap
metadata:
annotations:
.....

3. Restart the pinniped-supervisor deployment

kubectl rollout restart deployment -n vmware-system-pinniped pinniped-supervisor