HTTP 500 error in VCF Operations 9.0.x after vCenter SSO and Duo MFA redirection enabled
search cancel

HTTP 500 error in VCF Operations 9.0.x after vCenter SSO and Duo MFA redirection enabled

book

Article ID: 442644

calendar_today

Updated On:

Products

VCF Operations VMware vCenter Server

Issue/Introduction

When attempting to log in to VCF Operations 9.0.x or vCenter using a vCenter SSO authentication source integrated with Duo Multi-Factor Authentication (MFA), users encounter the following symptoms:

  • Successful authentication at the Identity Provider (vCenter/Duo).
  • An immediate 500 Internal Server Error upon being redirected back to the VCF Operations UI.
  • The UI may enter a redirect loop or become completely inaccessible for federated users.
  • There is no option to login as VCF Operations local admin when trying to access the login page due to the immediate redirect

In the web.log file, you see the following error:

ERROR web [com.vmware.vcops.ui.util.VCFOperationsUtil.postAuthenticate] - Cannot invoke "com.vmware.vcops.platform.api.UserContext.setVcfMode(boolean)" because "userContext" is nulljava.lang.NullPointerException: Cannot invoke "com.vmware.vcops.platform.api.UserContext.setVcfMode(boolean)" because "userContext" is null


In the federation-service.log file within the embedded VIDB on vCenter, the following warning is recorded:

WARN [Identity_Broker_Node]: federation ... com.vmware.vidm.common.validations.validator.impl.HttpHeaderValidatorImpl - [ValidationFailure] Header validation failed for host, value: [CODE_STRING]

Environment

  • VCF Operations 9.0.x
  • VCF Identity Broker 9.0.x (embedded)
  • vCenter Server 9.0.x (Enhanced Linked Mode)

Cause

This issue occurs when the vCenter SSO authentication source in VCF Operations 9.0.x is configured using legacy documentation (such as Aria Operations 8.18.x) instead of the native VCF 9.0.x configuration guidelines.

In VCF 9.0.x, the embedded Identity Broker performs stricter host header validation. If the source is manually misconfigured or relies on legacy redirection parameters, the Identity Broker rejects the incoming Duo MFA payload. This prevents the token claims from being parsed, resulting in an empty (null) user context when the application attempts to initialize the session.

There may also be a conflict with vCenter being is Enhanced Linked Mode (ELM). VCF Single Sign-On is not compatible with the vCenter Enhanced Linked Mode (ELM).**

Resolution

To resolve this issue, the invalid authentication source must be removed via the Suite-API and recreated following the VCF 9.0.x specific standards. The standard UI may be inaccessible due to the redirect failure.

The DELETE /api/auth/sources/{sourceId} endpoint requires explicit local administrator credentials to be passed directly, rather than using a standard API bearer token (OpsToken). Attempting to delete the source using an OpsToken will result in an HTTP 500 Internal Server Error.

Option 1: Delete via Suite-API Swagger UI (Recommended)

  1. || Create a snapshot of all VCF Operations cluster nodes. Snapshot Creation in VMware Aria Operations

  2. Navigate to https://operations.example.com/suite-api/doc/swagger-ui.html in a web browser.

  3. Authenticate into the Swagger interface using the local administrator credentials.

  4. Expand the Authentication Sources section and execute the GET /api/auth/sources endpoint. Locate the misconfigured vCenter SSO source in the response body and note its id value.

  5. Expand the DELETE /api/auth/sources/{sourceId} endpoint.

  6. Input the id value into the sourceId field.

  7. Input the required local administrator username and password values into the corresponding payload fields.

  8. Execute the request and verify the server returns a 204 response code, indicating successful deletion.

  9. Navigate to https://<VCF_OPS_FQDN>/ui in a new incognito browser session to verify the forced redirect has been cleared. Log in via the standard UI with the local admin credentials.


Option 2: Delete via Command Line (cURL)

  1. ||Create a snapshot of all VCF Operations cluster nodes. Snapshot Creation in VMware Aria Operations

  2. Log in to a terminal with network access to the VCF Operations cluster.

  3. Execute a GET request using basic authentication with local administrator credentials to retrieve the list of authentication sources. Replace <YOUR_ADMIN_PASSWORD> with the actual password: curl -k -u "admin:<YOUR_ADMIN_PASSWORD>" -X GET "https://<VCF_OPS_FQDN>/suite-api/api/auth/sources" -H "Accept: application/json"

  4. Locate the misconfigured vCenter SSO source in the JSON output array and note its id value.

  5. Execute the DELETE API call to remove the invalid authentication source. Replace <SOURCE_ID> with the ID identified in the previous step. You must pass the local admin credentials directly via basic authentication and the JSON payload, explicitly omitting the OpsToken header to avoid the 500 error:

    curl -k -u "admin:<YOUR_ADMIN_PASSWORD>" -X DELETE "https://<VCF_OPS_FQDN>/suite-api/api/auth/sources/<SOURCE_ID>" -H "Content-Type: application/json" -d '{"username": "admin", "password": "<YOUR_ADMIN_PASSWORD>"}'

  6. Navigate to https://<VCF_OPS_FQDN>/ui in a new incognito browser session to verify the forced redirect has been cleared. Log in via the standard UI with the local admin credentials.

 

Follow the VCF 9.0.x Configure a New VCF Single Sign-On for a VCF Instance documentation rather than the legacy Aria 8.18 guides to configure and enable SSO.

Additional Information

For details about the officially supported API(s), see: VCF Operations API Reference

** VCF Single Sign-On is not compatible with the vCenter Enhanced Linked Mode (ELM).
Deactivate Enhanced Link Mode from vCenter Using the cmsso-util break-elm Utililty

What is vCenter Enhanced Linked Mode

Deactivating Enhanced Linked Mode (ELM) in vCenter 9.0 (VVF)

Powered by Wolken Software