"Failed to connect to Active Directory" error when configuring VCF SSO

Products

• VMware Cloud Foundation

Issue/Introduction

• When configuring AD/LDAP as Identity Provider for VMware Cloud Foundation(VCF) Single Sign-On(SSO), the configuration fails. The following error is displayed on the Identity Provider Configuration page:
  
  Failed to connect to Active Directory, please check the configuration and try again. 
  
  
• Additionally, duplicate port entries can be found in the logs. The following error is recorded in /opt/vmware/idm/logs/accesscontrol-service.log inside the vidb service pod:
  
  Trying to establish a connection to Active Directory hosted on: (ldap://<ldap server ip address>:389:389)
Attempting to connect to Active Directory hosted on (<ldap server ip address>:389:389) and perform a bind operation with the following bindDn: (<bind user name>)
Unable to establish a connection to Active Directory or perform a bind operation, please check the configuration and try again.
Request failed with status_code: 400 with exception com.vmware.vidm.common.vertx.exceptions.WebApplicationException, cause: com.vmware.vidm.usergroup.model.exceptions.broker.connector.LdapDirectoryCommunicationFailureException.

Environment

VMware Cloud Foundation 9.1.0
VMware Cloud Foundation 9.0.x

Cause

This issue occurs due to a configuration error during the AD/LDAP integration.

When entering the information for the primary or secondary Domain Controller, including the protocol and port number (e.g. ldap://<ldap server ip>:389) causes a conflict. VCF automatically appends the port from the dedicated "Port" field, resulting in an invalid, malformed connection string (e.g. <ldap server ip>:389:389) and eventually causing the Active Directory connection to fail.

Resolution

To resolve this issue, separate the server address and the port number into their respective fields:

1. Domain Controller Field: Enter only the protocol, the IP address or the Fully Qualified Domain Name (FQDN) of the Active Directory server.
   Correct Format example: ldap://10.x.x.x or ldaps://<FQDN-AD-Sever>.
   Do not include the trailing port number.
2. Port Field: Enter the port number separately in its designated field (typically 389 for LDAP or 636 for LDAPS).
3. Save and re-test the configuration.

For detailed, step-by-step instructions on setting up identity providers, please refer to:Configure Active Directory as an Identity Provider Using AD/LDAP.