VMware Identity Manager integration and login failures in VMware Aria Operations for Logs (FIPS mode) behind a Load Balancer

Products

• VCF Operations
• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• When attempting to add a new Active Directory group in VMware Aria Operations for Logs, the configuration fails.

  • Reproduction Steps: Navigate to Management > Access control > Users and groups tab. Under the Directory groups section, click New group, add the domain and AD group, and click Save.

  • Resulting Error: The UI returns the following exception:

    ResourceException: Unexpected HTTP response from Workspace ONE Access instance. :: null Received unexpected response from Workspace ONE Access instance. Domain : <vIDM_FQDN>, Client ID : <Client_ID>.

• When attempting to sign in to the VMware Aria Operations for Logs portal using the "Sign in with Workspace ONE Access" option, the login fails with the following UI error:

  Failed to establish a connection with Workspace ONE Access. Please check the state of the Workspace ONE Access server.

• This issue is explicitly observed when the VMware Aria Operations for Logs environment is operating with FIPS mode enabled, and the VMware Identity Manager instance is fronted by an external load balancer terminating SSL.

• In the VMware Aria Operations for Logs /storage/core/loginsight/var/runtime.log log on the Primary node, you may observe HTTP 403 Forbidden responses during the GET request to /SAAS/jersey/manager/api/systeminfo.

• Running an OpenSSL connectivity test (openssl s_client -connect <vIDM_FQDN>:443 -showcerts) from the Aria Operations for Logs appliance to the vIDM endpoint fails with a TLS handshake error pointing to a bad Diffie-Hellman value:

  #################:error:#####:SSL routines:tls_process_ske_dhe:bad dh value:ssl/statem/statem_clnt.c:2085:

 

Environment

• VMware Aria Operations for Logs 8.x

• VMware Identity Manager 3.3.7

Cause

The external load balancer fronting the VMware Identity Manager deployment is presenting DHE (Ephemeral Diffie-Hellman) cipher suites with Diffie-Hellman parameters that do not meet FIPS compliance standards.

Because the VMware Aria Operations for Logs appliance is operating in FIPS mode, it enforces cryptographic compliance. During the TLS negotiation phase, the appliance rejects these non-compliant DHE parameters, causing the TLS connection to drop and the integration/authentication requests to fail.

Resolution

To resolve this issue, the TLS configuration must be modified directly on the external load balancer that fronts the VMware Identity Manager server.

Please implement the following changes:

1. Disable DHE Cipher Suites: Disable all DHE cipher suites in the load balancer's TLS configuration for the VMware Identity Manager virtual server endpoint.

2. Prioritize ECDHE Ciphers: Configure the load balancer to prioritize and prefer Elliptic-Curve (ECDHE) ciphers (e.g., ECDHE-RSA-AES256-GCM-SHA384).

Verification

Once the cipher adjustments are applied on the load balancer, verify the handshake by executing the following command via SSH from the Aria Operations for Logs primary node:

openssl s_client -connect <VIDM_FQDN>:443

The command should now successfully establish a connection, negotiating an ECDHE cipher without returning the bad dh value error. After confirming the connection via CLI, you can safely return to the UI and successfully add Directory Groups and sign in via VMware Identity Manager