401 Error and USER_NOT_FOUND Warning After Configuring VCF SSO in VCF Operations

Products

• VCF Operations

Issue/Introduction

After you configure VCF SSO through VCF operations in a greenfield environment, you are unable to log in to vCenter or NSX Manager. The following symptoms occur:
* You receive a 401 error when logging into these components.
* A test login fails with a warning that displays USER_NOT_FOUND.

Environment

VCF Operations 9.x

 

Cause

This issue occurs because the distinguishedName in VIDB is incorrectly mapped to the name claim in the OIDC token.

Resolution

To resolve this issue, you must update the attribute mapping in your configuration:
1. Navigate to the Identity Provider configuration settings in VCF Operations.
2. Locate the OIDC attribute mapping section.
3. Change the mapping so that userPrincipalName maps to preferred_username.
4. Verify that the preferred_username is populated correctly in the OIDC Token exchange response.
5. Save the configuration and perform a test login to confirm the `USER_NOT_FOUND` warning is resolved.

Example:

Additional Information

Configure Microsoft Entra ID as an Identity Provider Using OIDC