Error "Failed to log in with VCF SSO service. The user did not import or does not belong to any imported group." after integrating Microsoft Entra ID with VCF SSO

Products

• VCF Operations

Issue/Introduction

1. You have configured Microsoft Entra ID with VCF SSO by following Configure Microsoft Entra ID as an Identity Provider Using SAML and encounter the following error why trying to log in VCF Operations through VCF SSO.

Failed to log in with VCF SSO service. The user did not import or does not belong to any imported group.

2. When executing the following command on the vIDB primary node, the below logs are shown.

kubectl logs -f -n vidb-external -l app=vidb-service | grep userid

Domain":null,"actorUuid":null,"clientId":null,"deviceId":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/#.#.#.# Safari/537.36","workspaceId":null,"sourceIp":"#.#.#.#","objectType":"LOGIN_ERROR","objectId":"#######-####-####-####-#########","objectName":null,"values":{"isForceAuth":"false","loginUserDomainHint":"example.com","success":"false","failedAuthMethods":"[{\"reason\":\"DOMAIN_RECEIVED_MISMATCHES_CONFIG\",\"authMethod\":\"###-#####\",\"userPrincipalName\":\"[e-mail]\"}]","authMethods":"SAML","message":"Authentication failed."}}

Note: All user's actual information are marked with italic or "#".

Environment

VCF Operations 9.0.x

Cause

1. Misconfiguration in Entra portal - The following Attributes & Claims are missing.

userName
email
domain
firstName
lastName
groups

2. In VCF Operations UI > Fleet Management > Identity & Access > VCF Instance > Identity Source > Domain(s) and Group(s), two domains were added and one of which is not existing in Entra and not intended for VCF SSO use. The users in the issue belongs to both domains. The SAML assertion didn't had domain claim. VIDB was not able to distinguish two users belonging to two domains.

Resolution

1. In VCF Operations UI > Fleet Management > Identity & Access > VCF Instance > Identity Source > Domain(s) and Group(s), delete the domain that is not needed.

2. In Entra ID UI > Enterprise Appliacations > Single sign-on > Attributes& Claims, make sure the following Attributes & Claims are configured as shown in the screenshots.

Claim Name	Source Attribute	Transformation / Notes
userName	user.userprincipalname	Extract(): Before matching @
email	user.mail	Direct attribute mapping
domain	user.userprincipalname	Extract(): After matching @
firstName	user.givenname	Direct attribute mapping
lastName	user.surname	Direct attribute mapping
groups	user.groups	Group Claim: Select 'All Groups'; Source attribute: sAMAccountName

 

3. Attributes are case-sensitive. Make sure the attributes configuration in VCF Operations UI is matching the ones configured in Entra ID.

 

Additional Information

If a support request to be open, please attach the following information to the support request:

1. SAML-tracer extension is free to download and add to Chrome or Firefox. Run it while trying to log in. Click on the last POST line, go to SAML tab at the bottom, then upload the content from this tab.

2. Upload the log bundle from vIDB cluster.

For external vIDB, see Generating and downloading support logs for Identity Broker in VCF 9.

For embedded vIDB, the log bundle is stored on the management vCenter appliance. See Collecting diagnostic information for VMware vCenter Server.