Error: "Access Denied" during multi-domain SAML SSO login with SCIM provisioning in VCF Operations

Products

VCF Operations VMware vCenter Server 8.0 VMware NSX

Issue/Introduction

Users receive a "VMware Cloud Foundation, access denied. Access denied, unable to authenticate the user" error immediately after completing Multi-Factor Authentication (MFA) via PingFederate. This occurs in VCF Operations 9.x environments configured with SAML SSO and SCIM provisioning, specifically when utilizing multiple Active Directory domains.

Successful MFA completion is followed by an "Access Denied" screen in the VCF UI.
Users from the primary domain may log in successfully, while secondary domain users fail.
In VCF Operations, secondary domain users or groups appear with truncated or incorrect domain suffixes (e.g., user@domain.com instead of user@sub.domain.com).

Identity Broker logs (/var/log/vmware/vc-wsla-broker/federation-service.log) indicate:

com.vmware.vidm.federation.authenticator.oidc.OidcAuthenticationException: ID Token did not return expected nameld claim sAMAccountName

Environment

VMware Cloud Foundation (VCF) Operations 9.x

External Identity Provider: PingFederate

Cause

The failure results from a mismatch between the SAML assertion and the SCIM-provisioned user object. Hardcoded OGNL expressions or static parsing rules in the PingFederate configuration often truncate secondary domain suffixes during the SCIM sync. When a user logs in via SAML with a fully qualified identifier, the Identity Broker fails to match the live token against the malformed record in its database.

Resolution

Follow these steps to standardize identity claims and resolve domain truncation:
1. Standardize Identity Claims to User Principal Name (UPN):
- In PingFederate (SAML Assertion), change the SAML_SUBJECT fulfillment from username (Adapter) to the fully qualified userPrincipalName (LDAP).
- Ensure the NameID format passes the complete user@domain string for all domains.
2. Update SCIM Attribute Mapping:
- Map the SCIM userName attribute directly to userPrincipalName instead of using sAMAccountName or substring OGNL rules.
3. Apply Multi-Domain OGNL Expression (If applicable): Update the PingFederate Adapter Contract to handle multiple domain keys dynamically using the following logic:
```
#groupCnOnly = new java.util.ArrayList(), 
#groups = #this.get("ds.domain1.memberOf") != null ? #this.get("ds.domain1.memberOf").getValues() : (#this.get("ds.domain2.memberOf") != null ? #this.get("ds.domain2.memberOf").getValues() : {}), 
#groups.{ #group = #this, #group = new javax.naming.ldap.LdapName(#group.toString()), #cn = (#group.size() == 0) ? null : #group.getRdn(#group.size() - 1).getValue().toString(), #groupCnOnly.add(#cn) }, (#this.get("ds.domain1.memberOf") != null || #this.get("ds.domain2.memberOf") != null) ? new org.sourceid.saml20.adapter.attribute.AttributeValue(#groupCnOnly) : null
```
4. Transition to Just-In-Time (JIT) Group Provisioning: To eliminate manual sync issues, enable JIT Provisioning in VCF SSO:
- Create target AD Group mappings in VCF Operations manually for each domain.
- Assign roles to these group objects.
- VCF automatically provisions users upon their first successful login based on the SAML memberOf assertion.

For detailed, guidance on these configuration items, see Configure VCF SSO with modern identity provider for authentication and AD/LDAP for user-group provisioning.

Additional Information

Successful group provisioning via AD/LDAP (syncing) does not guarantee successful Name ID claim mapping for the SSO authentication token. The Identity Provider health status appearing "green" in VCF Operations does not rule out incorrect token content or claim mapping. You may also see InvalidTokenException and Suite Token is not present in the logs when troubleshooting this issue.

Additional error found in the /var/log/vmware/vc-wsla-broker/accesscontrol-service.log:

[ValidationFailure] Header validation failed for host, value: <ENCODED_VALUE>

For this error, use KB - "Could not create indirect identity provider" when trying to configure an Identity Provider for SSO Using PingFederate Type. to check for an incomplete or missing certificate chain for the Identity Provider endpoint.