Reconfiguring an Identity Source on SDDC Manager fails with the error "Registration of SDDC Manager as Relying Party failed due to ("BAD_REQUEST","error_code": 2097... "Thumbprint mismatch for <ThumbprintID> Check that the thumbprint is correct")"

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

When configuring or changing Identity Source settings on SDDC Manager, the SDDC manager does not update successfully, showing the error:
"Registration of SDDC Manager as Relying Party failed due to ("BAD_REQUEST","error_code": 2097... "Thumbprint mismatch for <ThumbprintID> Check that the thumbprint is correct")"

Environment

SDDC Manager 5.2.x

Cause

A thumbprint mismatch between a vCenter managed by SDDC and the NSX Manager causes the Identity Source update to fail.

Resolution

1. Retrieve vCenter Thumbprint
   • Obtain the current SHA-256 thumbprint of the vCenter Server certificate. In the SDDC CLI run:
     

     curl -k -X GET https://<nsx-mgr>/api/v1/trust-management/oidc-ruis -u admin

   • Capture the correct thumbprint value for the vCenter
2. Update NSX Manager via API
   • Run the following call to update the OIDC URI thumbprint:

   • curl -k -X POST "https://<nsx-mgr>/api/v1/trust-management/oidc-uris?action=update_thumbprint" \ -u 'admin:<password>' \ -H "Content-Type: application/json" \ -d '{ "oidc_uri": "ebd3032d-728e-44d4-9914-d4f81c9972cb", "<invalid_thumbprint>" : "<new-thumbprint>" }'
     

   • Update a OpenID Connect end-point's thumbprint
3. Attempt to register Identity source settings via the SDDC manager.

Optional: If the Entra ID configuration was removed from the vCenters and SDDC at any point during troubleshooting, make sure that provisioning is restarted on the Entra ID SCIM via the "Restart Provisioning" button, as user and group information may have been lost during Identity Source reconfiguration.