Incorrect Issuer mismatch error "SAML authRequest" in vIDM Cluster

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• The VMware Identity Manager (vIDM) System Diagnostics Dashboard shows OpenSearch - Health Unknown.
• The OpenSearch cluster node count is showing as 2 instead of 3.

Environment

VMware Identity Manager 3.3.7

Cause

This issue occurs when default JVM Garbage Collection log rotation policies allow log accumulation to saturate the local partition, preventing dependent services from writing mandatory initialization data and causing a silent startup failure.

Resolution

Step:1 Execute the following commands on the affected node to reclaim critical disk space on the root partition and fix log file corruption before attempting to start the cluster.

1. Stop Opensearch service:
   /etc/init.d/opensearch stop
   
   
2. Remove Garbage Collection (GC) logs:
   rm -f /opt/vmware/opensearch/logs/gc.log*
   
   
3. Delete horizon logs older than 30 days:
   find /opt/vmware/opensearch/logs -name "*horizon*" -name "*.gz" -mtime +30 -delete
   
   
4. Remediate Corrupted btmp Files:
   truncate -s 0 /var/log/btmp
chown root:utmp /var/log/btmp && chmod 660 /var/log/btmp

Step:2 Sequential Cluster Initialization.
To ensure proper cluster state formation, the nodes must be started sequentially. After starting the service on each node, wait at least 30 seconds and monitor the startup logs using the verification command before proceeding to the next node.

Order	Node	Action Command	Verification Command
1	Node 01 (Master)	/etc/init.d/opensearch start	tail -f -n 30 /opt/vmware/opensearch/logs/horizon.log
2	Node 02	/etc/init.d/opensearch start	tail -f -n 30 /opt/vmware/opensearch/logs/horizon.log
3	Node 03	/etc/init.d/opensearch start	tail -f -n 30 /opt/vmware/opensearch/logs/horizon.log

Step:3 OpenSearch Cluster Health Validation

curl http://localhost:9200/_cluster/state/nodes,master_node?pretty

curl http://localhost:9200/_cluster/health?pretty


Note: If the issue still persists please raise a ticket with Broadcom support referencing this article.

Additional Information

For user/group search issue follow the KB : Unable to search certain users & groups in vIDM UI or assign users & groups to policies