Unable to Log In to VCF Operations Using VCF SSO – "Failed to log in with VCF SSO service"

Products

• VCF Operations

Issue/Introduction

Login to VCF Operations fails, the same VCF SSO service continue to function successfully with other products and components that are configured to use the same SSO source.

 

The following errors can also be observed in the /storage/log/vcops/log/analytics-*.log file:

javax.net.ssl.SSLHandshakeException: PKIX path building failed:sun.security.provider.certpath.SunCertPathBuilderException:unable to find valid certification path to requested target

Environment

• VCF Operations 9.0.x
• VCF Identity Broker 9.0.x

Cause

This issue is caused by a certificate trust problem between VCF Operations and the configured SSO service.

During the authentication process, VCF Operations is unable to establish a trusted SSL connection to the SSO provider because it cannot validate the certificate chain presented by the target system. As a result, the SSL handshake fails and SSO authentication cannot be completed.

Resolution

Note: Please ensure to secure an on-demand backup of VCF Identity Broker component.

 

Perform a localized reset of the SSO configuration for VCF Operations. 

Procedure:

1. Perform a localized Reset SSO operation for VCF Operations.
2. Allow the reset process to complete.
3. Configure the connection to the SSO source.
   1. Log in to the VCF Operations UI as a local admin: https://<OPS_FQDN_or_IP>/ui
   2. In the left navigation pane, go to: Fleet Management ➔ Identity & Access
   3. In the Identity & Access pane, select: VCF Management ➔ Operations appliance
   4. Under Enable Single Sign-On, click Continue.
   5. When the Role Assignment Required dialog appears, check: “I confirm that I understand the requirement to perform role assignments in order to enable SSO for the selected component(s).”
   6. Then click Continue.
   7. On the Configure Component page, select the VCF Identity Broker from the dropdown list.
   8. Click Configure.
   9. When the Role Assignment Required dialog appears again, confirm the checkbox and click Continue.
4. Login to VCF Operations as a local admin: https://<OPS_FQDN_or_IP>/ui
5. Import the required users and groups into Access Control.
   1. Navigate to: Administration ➔ Control Panel ➔ Access Control
   2. Go to the User Accounts or User Groups tab.
   3. Click the horizontal ellipsis (⋯) next to the Add button and select: Import from Source
   4. In the Import page, set the Import From field to: VCF SSO
   5. Use the Search Prefix field to find users or groups, then click Finish.
   6. After the users and/or groups appear in the Access Control list, select the entry.
   7. Click the vertical ellipsis (⋮) and choose Edit.
   8. Under Assign Roles and Scope, assign the appropriate roles and scopes.
   9. Click Save.
6. Validate that users can successfully authenticate using the VCF SSO option.