Unable to log into the TMC Self Managed using oidc authentication with 'errcode: 3012 errmsg: Forbidden requestid: ########-####-####-####-############'

Products

• VMware Tanzu Platform - Kubernetes

Issue/Introduction

Unable to log into the TMC-SM using oidc authentication.

When logging in below error is received:

errcode: 3012 errmsg: Forbidden requestid: ########-####-####-####-############

after authenticating via Microsoft oidc authentication at https://landing.<FDQN>/callback?state=################################ page.

When checking the TMC Self Managed pods in particular the landing-service-server pod below error:

"level":"error","msg":"errcode: 3012 errmsg: Forbidden requestid: ########-####-####-####-############ cause: insufficient access: admin role not found"

 

Environment

TMC Self Managed 1.4.4

Cause

The admin role was not being found and therefore authentication could not occur.

As the correct group was not being found authentication could not take place with the group set in the values yaml.

App role for tmc-admin and tmc-member were configured instead of tmc:admin and tmc:member groups.

The values yaml configure similar to below:

..
oidc:
  authorizationScopes:
    - openid
    - profile
    - email
  claimGroups: groups
  claimUsername: email
  clientID: ########-####-####-####-############
  clientSecret: ########################################
  issuerURL: https://login.microsoftonline.com/########-####-####-####-############/v2.0
  issuerType: pinniped
...

Note - claimGroups is set to groups and not roles.

Resolution

Correct method is to configure as per doc here ie to have tmc:admin and tmc:member groups configured and assigned in AD as groups

However, In this scenario app roles tmc-admin and tmc-members were configure for and and not groups.

The values.yaml was configured with 'claimGroups: groups 'as per below

...
oidc:
  authorizationScopes:
    - openid
    - profile
    - email
  claimGroups: groups
  claimUsername: email
  clientID: ########-####-####-####-############
  clientSecret: ########################################
  issuerURL: https://login.microsoftonline.com/########-####-####-####-############/v2.0
  issuerType: pinniped
...

and below idpGroupRoles also below

...
idpGroupRoles:
  admin: tmc-admin
  member: tmc-members
...

If have set for app roles  then the values.yaml will need to be configured to include below update

...
claimGroups: roles
...

Note - Change from 'claimGroups: groups'.

Checking with below command should pull the correct groups tmc-admin tmc-member (as set by customer).

kubectl -n tmc-local get secret --no-headers -o custom-columns=":metadata.name" \  | grep pinniped-storage-access-token \  | xargs -i kubectl -n tmc-local get secret {} -ojsonpath='{.data.pinniped-storage-data}' | base64 -d | jq .

The output command above was initially showing below with blank groups, after an update on identity provider side this list was populated but did not have tmc-admin or tmc-member in the list.