vCenter 9.1.x Login with SSO fails with error: Token groups claim 'group_names' contains a group with an invalid UPN format

Products

• VMware vCenter Server
• VCF Operations
• VMware Cloud Foundation

Issue/Introduction

• The VCF/VVF environment is configured with Microsoft Entra ID as an Identity Provider using SAML
  
  
• The configuration is using Groups for VCF roles assignment
  
  
• When attempting to connect using any user of the configured Groups it returns a HTTP 400 Bad Request error
  
  
• In the vCenter logs we are seeing errors similar to the excerpt below:
  
  

  /var/log/vmware/sso/tokenservice.log
  yyyy-mm-ddThh:mm:ss.zzz WARNING vmidentity-tokenservice 55 [vc@4413 threadName="tomcat-http--14" logger="com.vmware.vcenter.tokenservice.verifiers.Ws1VerifiableJwtToken" corId="<corId>" opId="<opId>"] Encountered group name in token claim group_names with non-UPN format: NETBIOS_DOMAIN\sAMAccountName@<DOMAIN>
  yyyy-mm-ddThh:mm:ss.zzz ERROR vmidentity-tokenservice 55 [vc@4413 threadName="tomcat-http--14" logger="com.vmware.vcenter.tokenservice.vapi.TokenExchangeProviderImpl" corId="<corId>"] Exchange failed due to invalid grant:
  com.vmware.vcenter.tokenservice.exceptions.InvalidGrant: Token groups claim 'group_names' contains a group with an invalid UPN format: NETBIOS_DOMAIN\sAMAccountName@<DOMAIN>

   
  

  /var/log/vmware/sso/tokenservice.log
  yyyy-mm-ddThh:mm:ss.zzz WARNING vmidentity-tokenservice 55 [vc@4413 threadName="tomcat-http--14" logger="com.vmware.vcenter.tokenservice.verifiers.Ws1VerifiableJwtToken" corId="<corId>" opId="<opId>"] Encountered group name in token claim group_names with non-UPN format: NETBIOS_DOMAIN\sAMAccountName@<DOMAIN>
  yyyy-mm-ddThh:mm:ss.zzz ERROR vmidentity-tokenservice 55 [vc@4413 threadName="tomcat-http--14" logger="com.vmware.vcenter.tokenservice.vapi.TokenExchangeProviderImpl" corId="<corId>"] Exchange failed due to invalid grant:
  com.vmware.vcenter.tokenservice.exceptions.InvalidGrant: Token groups claim 'group_names' contains a group with an invalid UPN format: NETBIOS_DOMAIN\sAMAccountName@<DOMAIN>

Environment

VCF 9.1.x

vCenter Server 9.1.x

Cause

In Microsoft Entra ID configuration the group name is in UPN format.

When we configure the attribute mappings for groups, we need to configure it to emit groups name and not UPN.

Resolution

Steps to resolve the issue:

1. In the Microsoft Entra ID admin portal for the Enterprise App named "Uconnect Microsoft Entra ID":
   • Navigate to Enterprise Applications → select the VIDB SAML app
   • Go to Single sign-on → User Attributes & Claims
   • Find the claim that produces the group value (likely under Additional claims or Groups claim)
   • The current format sends NETBIOS_DOMAIN\sAMAccountName → <DOMAIN>\<GROUP_NAME>
   • Change the source attribute to emit just the sAMAccountName (without domain prefix)
     
     
2. Re-apply the domain mapping following the documentation below:
   Configure Microsoft Entra ID as an Identity Provider Using SAML
   
   

3. Re-register the group

   • Remove the existing VCF role assignments for <DOMAIN>\<GROUP_NAME> in VCF Operations

   • Log in via SSO for a user who is a member of this group. VIDB provisioning will create a new group record named <GROUP_NAME> (without prefix)

   • Then, Add the same roles to <GROUP_NAME> (the newly provisioned clean group)

4. Verify
   
   
   • Test SSO login for a user who is a member of this group.