Orchestrator UI login fails with OrgIdMismatchException after certificate change

Products

• VCF Automation

Issue/Introduction

After replacing or updating security certificates in a multi-tenancy environment, users are unable to log in to the Automation Orchestrator UI. Attempts to authenticate fail, and the following error signature is logged in the /services-logs/prelude/vco-app/file-logs/vco-server-app.log file:

ERROR vcO [host='<vco_pod>' thread=' http-nio-8280-exec-2' user='-' org= trace='-"] () com. vmware.olln.security.csp.web.FilterChainExceptionHandler - Spring Security Filter Chain Exception com.vmware.olln.security.csp.OrgIdMismatchException: Logins are restricted to the default for this Automation orchestrator organisation

Environment

• Automation Orchestrator 8.18.x

• Aria Automation 8.18.x

 

Cause

The com.vmware.olln.security.csp.OrgIdMismatchException occurs because the identity provider context on the Spring Security Filter Chain loses its mapping alignment following the certificate update. The authentication filter explicitly blocks access when incoming traffic targeted at tenant endpoints evaluates against an outdated or base organization configuration.

Resolution

To resolve this issue, the authentication provider must be unregistered and re-registered using the tenant-specific FQDN via the command-line interface:

1. Open an SSH session to the Automation Orchestrator appliance. Note that in multi-node or clustered environments, these commands must only be executed on a single cluster node.

2. Unregister the current authentication provider configuration by executing the following command:

   vracli vro authentication unregister -u <auth_provider_username@domain> 

3. Initialize the interactive authentication provider registration wizard:

   vracli vro authentication wizard
   

4. Follow the interactive prompts. When configured for multi-tenancy, ensure the hostname entered for the authentication provider matches the tenant-vra-fqdn and not the baseline primary vra_fqdn.

Additional Information

For comprehensive details on command-line authentication provider setup, see Configuring the Automation Orchestrator Authentication Provider with the Command Line Interface.