Different login redirect behavior when accessing vCenter via alias

Products

• VMware vCenter Server

Issue/Introduction

You have multiple vCenter instances in environment.

Alias was set up following instruction in "[400] An error occurred while sending an authentication request" while logging in to vSphere Client using the vCenter Server shortname

 

You encounter similar behaviour like

 

vCenter 1: Redirects to the hostname, but after successful login, it redirects back to the alias.
vCenter 2: Redirects to the hostname and remains on the hostname after successful login.

 

In envoy logs located at /var/log/vmware/envoy on vCenter 2 you see similar entries 

info envoy[####] [Originator@#### sub=Default] ####-##-##T##:##:##.### GET /ui/login?idp=customer ###

 

In vCenter 2 vsphere_client_virgo logs located at /var/log/vmware/vsphere-ui/logs you see similar entries

[INFO ] p-nio-127.0.0.1-####-exec-## ####### ###### ###### com.vmware.vsphere.client.security.oauth2.LoginRequestHandler     Received Multi login request 
[INFO ] p-nio-127.0.0.1-####-exec-## ####### ###### ###### com.vmware.vsphere.client.security.oauth2.LoginRequestHandler     Redirecting to url with system PNID: https://vCenter1-FQDN.com/ui 

 

 

In vCenter 1 vsphere_client_virgo logs located at /var/log/vmware/vsphere-ui/logs you don't see ""Redirecting to url with system PNID" messages.

 

Environment

vSphere 8.x

Cause

The reason for the different login redirect behaviour is the custom identity provider being used in above example with vCenter 2.

 

On the vCenter 1 custom identity provider is not set. For this reason, the login flow uses the build in local websso provider.

 

 

Resolution

 To have same behaviour you can use one of these options.

 

Option 1

Set up custom IDP on both vCenter instances following Configuring vCenter Server Identity Provider Federation

 

Option 2

To have same behaviour when logging to vCenter 2 as on vCenter 1 you can use following parameter

https://vCenter 2-alias.com/ui/login?idp=local