Frequent Pinniped Authentication Prompts Every ~2 Minutes When Using ADFS as External Identity Provider with Tanzu Supervisor
Article ID: 412874
Updated On:
Products
Issue/Introduction
In environments using vCenter federated with Microsoft ADFS as an external IDP for the latest vSphere Supervisor releases, repeated authentication prompts occur when logging in through the Tanzu CLI with Pinniped. Authentication works initially, but after approximately two minutes of idle time the user is prompted again to re-authenticate. This cycle repeats consistently, impacting normal workflow.
Environment
- vSphere Supervisor 8.0
- vSphere Supervisor 9.0
Cause
The short session timeout is due to the lifetime of Pinniped-issued tokens, which is not configurable in the latest vSphere Supervisor releases. In addition, ADFS does not fully implement the OIDC specification, leading to refresh token errors. These issues have been addressed in Pinniped v0.41.0.
Resolution
There is no supported configuration change in the current release to extend the session lifetime. The resolution requires a Supervisor update that includes Pinniped v0.41.0 or later, along with updated configuration for ADFS integration. Manual upgrades of Pinniped pods are not supported and are not recommended. The fix will be available with vSphere 8.0U3P07 which will include pinniped v0.41.0.
Additional Information
Subscribe to this article for updates:
Feedback
