VCF Operations Login Fails with Invalid Redirect URL via Load Balancer or Alias

Products

• VCF Operations

Issue/Introduction

• When attempting to log in to VCF Operations 9.x using an alias (e.g., CNAME) or a Load Balancer VIP (Virtual IP) instead of the primary node's FQDN, the login fails.
• When accessing the VCF Operations UI through an alias, the following error is displayed:
  

  Please contact your VCF Admin with the below details for resolution.
  Message
  Invalid redirect URL https://<internal-url>/ui/vidbClient/vidb/ specified in authorize request
  Error Code
  oauth2.request.invalid.redirecturl

Environment

VCF Operations 9.x

Cause

This issue occurs because the VMware Identity Broker (VIDB) only authorizes redirect URIs explicitly registered during initial SSO configuration. When environments utilize custom load
balancer templates (e.g., HAProxy) or CNAME aliases, the System Access URL can become desynchronized with the VIDB. Consequently, if a user accesses the UI via an unregistered alias or Virtual IP (VIP), the redirect_url sent by the browser will not match the authorized list, causing the OAuth2 security filter to reject the request with the oauth2.request.invalid.redirecturl error

Resolution

To resolve this issue, update the System Access URL in VCF Operations to match the alias or VIP being used. This ensures that the application provides the correct redirect URI during the authentication flow.

1. Log into the VCF Operations UI using a Local Administrator account via the primary node's FQDN.
2. Navigate to Administration → Global Settings → System Settings.
3. Locate the System Access URL field.
4. Enter the full URL (including https://) that users will use to access the site (e.g., https://vops-alias.example.com).
5. Click Save.

Additional Information

If the issue persists after updating the System Access URL, contact Broadcom Support through Creating and managing Broadcom cases