vSphere Cloud Account creation using federated Identity Providers ( Okta, Microsoft Entra ID, etc.) fails

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• When attempting to create a vSphere Cloud Account in VMware Aria Automation for a vCenter Server environment configured with federated identity provider (IDP) such as Okta, Microsoft Entra ID etc., the validation fails.

• The provisioning-service-app.log will show the following error when creating the cloud account:

  Failed to connect to vCenter: Error: Cannot complete login due to an incorrect user name or password. Exception [com.vmware.vim25.InvalidLoginFaultMsg: Cannot complete login due to an incorrect user name or password.

• This issue is present even when a service account is configured in vCenter for MFA bypass and the user can successfully log into the vCenter web user interface with the federated account.

Environment

VMware Aria Automation 8.x

Cause

VMware Aria Automation does not support using an federated domain user account to create a vSphere Cloud Account. While vCenter Server supports IDP federation for UI-based logins, the API authentication methods used by VMware Aria Automation for Cloud Account validation and subsequent enumeration do not support this configuration.

Resolution

You must use a local vSphere account (e.g., a vsphere.local service account) or a traditional LDAP service account that is not integrated with the federated IDP for creating the vSphere Cloud Account in VMware Aria Automation.

Additional Information

• Refer to the product documentation for the correct process for creating a vCenter Cloud Account - Create a basic vCenter cloud account in VMware Aria Automation