Role Binding Synchronization Fails with "CF-UnprocessableEntity" During Org Group Creation in Tanzu Platform 10.4
Article ID: 444966
Updated On:
Products
Issue/Introduction
While configuring the Multi-Foundation CF Push feature in Tanzu Platform, administrators may encounter role-binding synchronization failures when creating an Organization Group (Org Group) in Tanzu Hub.
Initial configuration attempts using the default tanzu_platform_admin account may yield a 401 Unauthorized token exchange error. To resolve this, administrators typically create the tanzu_platform_admin user in the local UAA of the target foundations and assign the necessary scopes (cloud_controller.admin, uaa.admin, scim.read, scim.write).
However, while UAA authentication succeeds, the subsequent role-binding synchronization performed by Tanzu Hub fails. The Tanzu Hub ensemble-service attempts to bind the Org Manager role using the email address associated with the Hub user (admin@test.org) rather than the username (tanzu_platform_admin).
This results in the following CF-UnprocessableEntity errors in the Tanzu Hub UI/logs:
2026-06-06T11:15:47.948Z [INFO] Assigning role 'organization_group_manager' to 'admin@test.org' across 2 foundations
2026-06-06T11:15:49.086Z [ERROR] Role 'organization_group_manager' assignment to 'admin@test.org' failed in 2 of 2 foundations
2026-06-06T11:15:49.667Z [ERROR] Foundation entity vrn/provider:TAS/instance:p-bosh-f44c369c89c0710c30b2/Organization:f7010c8b-4b32-4d1d-81db-1db37e277a8b: status=MISSING, error=10008:CF-UnprocessableEntity:No user exists with the username 'admin@test.org'.. Please check and ensure Platform Services tile is at latest version. The minimum version is 10.4
2026-06-06T11:15:51.381Z [ERROR] Foundation role creation failed for bindingId a60fc1d1-2443-4484-8f55-c836bab3d631: 2/2 foundations failed. Please check and ensure Platform Services tile is at latest version. The minimum version is 10.4
Environment
Tanzu Platform for Cloud Foundry 10.4.x
Tanzu Hub 10.4.x
Cause
This behavior is functioning as designed and is not an architectural gap.
Tanzu Hub uses the email ID as the primary identifier when creating role bindings and synchronizing them to target foundations. This design aligns with standard Elastic Application Runtime (EAR) configurations, where the username and email typically map 1:1 to the user's email address in external Identity Providers (IDPs) via the OIDC email claim.
The issue occurs because the default internal Hub user (tanzu_platform_admin) is configured with a mismatch between its username and email attributes:
- Username: tanzu_platform_admin
- Email: admin@test.org
Because Tanzu Hub attempts to synchronize the role using the email attribute, the target Cloud Foundry foundation rejects the request, as a user named admin@test.org does not exist in its local Cloud Controller database.
Resolution
To resolve this issue and successfully utilize Multi-Foundation CF Push capabilities, implement one of the following solutions:
Option 1: Use an External IDP (Recommended)
Integrate Tanzu Hub and your Cloud Foundry foundations with an external Identity Provider (SAML/OIDC). When using an external IDP, ensure the "Username claim" is mapped to the user's email. This naturally prevents the issue, as the username and email will be identical across the fleet.
Option 2: Create a Dedicated Operational Local User
Do not use the default tanzu_platform_admin account for day-to-day operations or multi-foundation deployments. Instead, create a new operational user where the username and email are identical.
In Tanzu Hub: Create a new local user (e.g., thub-admin@tanzu.net) where the username and email match. Assign this user the GLOBAL administrator role.
In Foundation UAA: Create the exact same user (e.g., thub-admin@tanzu.net) in the local UAA of all target foundations.
Assign Scopes: Grant the new user the cloud_controller.admin scope within the foundation UAA using the uaac CLI.
Option 3: Immediate Workaround for Existing Setup
If you must proceed with the default tanzu_platform_admin account for testing purposes, you must manually bridge the identity gap by creating an additional user record in the target foundations:
Log into the target Cloud Foundry foundations via the CF CLI as an admin.
Explicitly create the email user: cf create-user admin@test.org <password>
Retry the Org Group creation in Tanzu Hub.
Additional Information
The tanzu_platform_admin account is strictly intended to be a "break-glass" emergency account used only to bootstrap the system and set up initial IDP integrations or other administrative users. It is not intended for standard platform operations.
Feedback
