VCF SSO Configuration Failure for Workload Domain vCenter Managed by SDDC Manager
search cancel

VCF SSO Configuration Failure for Workload Domain vCenter Managed by SDDC Manager

book

Article ID: 416058

calendar_today

Updated On:

Products

VMware vCenter Server VCF Operations VMware SDDC Manager / VCF Installer

Issue/Introduction

  • When attempting to configure VCF Single Sign-On (SSO) for a vCenter component within a Workload Domain managed by SDDC Manager or Fleet Manager, the process fails. Users may observe that the Identity Broker (vIDB) node is successfully connected to LDAPs, yet the component configuration status remains "Failed" in the VCF Operations interface.
  • This issue typically occurs in the VCF Operations interface under the following path:

Fleet Management → Identity & Access → VCF Instances → [domain name] → Component Configuration

  • Error occurred while configuring the component for SSO.

Check Support Logs under Control Panel for more details. The following error message appears in the user interface (UI)

  • On checking the /storage/log/vcops/log/adapters/ManagementAdapter/ManagementAdapter.log on VCF operation we see the following error;

YYYY-MM-DDTHH:MM:SEC:MSECZ ERROR ManagementAdapter 6283 [ops@4413 threadId="85105" threadName="TasksManager-TaskHandler-1082" instanceId="33208"] [(33208) com.vmware.adapter.management.components.iam.task.authsource.configurator.VCAuthSourceConfigurator.createAuthSource] -  Httpstatus 500 INTERNAL_SERVER_ERROR error while configuring auth source for VC. Check logs for more details.

com.vmware.adapter.management.components.iam.exception.HttpResponseStatusException: API call https://<WLD-vCenter_FQDN>/api/vcenter/identity/providers failed with status 500 and error {"error_type":"INTERNAL_SERVER_ERROR","messages":[{"args":["com.vmware.vapi.std.errors.Error"],"default_message":"Provider method implementation threw unexpected exception: com.vmware.vapi.std.errors.Error","id":"vapi.bindings.method.impl.unexpected"},{"args":["SDDC Manager restricts configuring an identity provider on this vCenter Server. Please use SDDC Manager UI/API to configure an identity provider."],"default_message":"SDDC Manager restricts configuring an identity provider on this vCenter Server. Please use SDDC Manager UI/API to configure an identity provider.","id":"com.vmware.vcenter.trustmanagement.error"}]}

  • Upon reviewing the vCenter Server configuration, the setting Allow Broker Configuration is shown as false, which prevents the Identity Provider from being configured outside of SDDC Manager.

Environment

VMware Cloud Foundation 9.x 

Cause

  • This issue occurs due to a design change introduced in vCenter Server when managed by SDDC Manager.
  • SDDC Manager enforces a control setting (config.SDDC.Deployed.AllowBrokerConfiguration) that prevents the manual addition of an external Identity Provider (IdP) directly to any Workload Domain vCenter.
  • In this configuration, only SDDC Manager is allowed to manage Identity Provider integrations for those vCenter Servers.
  • If a configuration drift is detected or if this control setting is set to false, attempt to configure SSO through VCF Operations interface will fail.

Resolution

  1. Log in to the SDDC Manager portal.
  2. Navigate to Workload Domains > [Affected Domain] > Configuration Updates.
  3. Locate the drift item: AllowBrokerConfigurationConfigDrift.
  4. Select the item and click Remediate to apply the update.
  5. Once remediation is complete, verify the vCenter advanced setting config.SDDC.Deployed.AllowBrokerConfiguration is now True.
  6. Return to VCF Operations > Fleet Management > Identity & Access and retry the SSO Configuration.

Note: Do not manually modify vCenter advanced settings as this may cause future update failures. If the issue persists, verify that the vCenter is not integrated twice (e.g., once by FQDN and once by IP) and ensure integration credentials are current

Additional Information

If the issue persists after remediation, check whether the vCenter Server still has a previously configured Identity Provider. Multiple or stale Identity Provider entries can also prevent successful SSO configuration.
For detailed steps to verify and remove an old Identity Provider, refer to the following article: Unable to configure VCF SSO vCenter component for workload domain

Powered by Wolken Software