Error: "Access Denied" when using Microsoft Entra ID (SCIM) Login Fails

Products

• VCF Operations

Issue/Introduction

When attempting to log in to VMware Cloud Foundation (VCF) 9.x components using Microsoft Entra ID (OIDC/SCIM), users encounter the following issues:

• The login attempt fails with the error message: Access denied. Unable to authenticate the user.
• SCIM synchronization issues where only a single user from a configured group successfully syncs.
• The environment was previously working with LDAPS before switching to Entra ID with SCIM.

Environment

VCF Operations 9.0.x /9.1

VCF Identity Broker 9.0.x /9.1 

Cause

An incorrect configuration of Entra ID claims and the VCF SSO Identity Provider (IDP) mapping causes this issue.

• The externalId claim was incorrectly mapped to mailnickname instead of the unique Object ID (oid).
• For Microsoft Entra ID, the unique OIDC claim for a user principal must be oid. If the externalId in the Entra ID token does not map to the Object ID, VCF SSO cannot correctly identify the user after successful authentication.
• In VCF versions 9.0.x and 9.1, square bracket characters [] in display names or attributes are not supported and can cause authentication failures.

Resolution

To resolve this issue, reset and reconfigure the SSO configuration with the correct attribute mappings.

Step 1: Update Entra ID Mapping

Ensure that in the Microsoft Entra ID configuration:

1. Update the mapping for externalId to objectId instead of mailnickname.
2. Reset the SSO configuration How to Reset SSO in VCF 9.0 , as the user is already provisioned in the vIDB with mailnickname.
3. Use oid as the Unique OIDC Attribute during the configuration of IDP.

Step 2: Reconfigure SSO in VCF Operations

1. Log in to the VCF Operations UI.
2. Navigate to Fleet Management > Identity & Access.
3. Select the relevant VCF Instance and click Identity Source.
4. Edit the VCF SSO configuration and set the Unique Identifier mapping to oid.
5. Enter the Shared Secret for the Entra ID Application and save the changes.

Additional Information

Login to vCenter 9.x with Entra ID account fails with "Access denied, Unable to authenticate the user" due to Unique Identifier mismatch