An error when trying to log in to Cloud Director using SSO account Azure Entra configured with SAML: login-failure-graphic

Products

• VMware Cloud Director

Issue/Introduction

•  When trying to login in vCD using the SSO account (Azure Entra configured with SAML) getting below error (login-failure-graphic) after making changes to the vCD FQDN.
  
• In vcloud-container-debut.log, you may observe the below entries:
  

  DEBUG    | pool-jetty-74543          | CustomWebSSOProfileConsumerImpl | Validation of authentication statement in assertion failed, skipping | requestId=<request-id>request=POST <vCD-Login-URL-for tenant>,requestTime=<time>,remoteAddress=##.##.##.###:#####,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=text/html application/xhtml+xml application/xml;q 0.9 image/avif image/webp image/apng */*;q 0.8 application/signed-exchange;...
  org.opensaml.xml.validation.ValidationException: Signature is not trusted or invalid
          at org.springframework.security.saml.websso.AbstractProfileBase.verifySignature(AbstractProfileBase.java:272)
          at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertionSignature(WebSSOProfileConsumerImpl.java:419)
  ..
  ..
  
  
  DEBUG    | pool-jetty-74543          | SAMLAuthenticationProvider     | Error validating SAML message | requestId=<request_id>,request=POST <vCD-Login-URL-for tenant>,requestTime=<time>,remoteAddress=##.##.##.###:#####,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=text/html application/xhtml+xml application/xml;q 0.9 image/avif image/webp image/apng */*;q 0.8 application/signed-exchange;...
  org.opensaml.common.SAMLException: Response doesn't have any valid assertion which would pass subject validation
          at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:229)
          at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:88)
  
  ..
  ..
  ..
  Caused by: org.opensaml.xml.validation.ValidationException: Signature is not trusted or invalid
          at org.springframework.security.saml.websso.AbstractProfileBase.verifySignature(AbstractProfileBase.java:272)
          at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertionSignature(WebSSOProfileConsumerImpl.java:419)
  
  
  INFO     | pool-jetty-74543          | SAMLDefaultLogger              | AuthNResponse;FAILURE;##.##.##.##;#####;https://sts.windows.net/#######-####-####-####-###########/;;;org.opensaml.common.SAMLException: Response doesn't have any valid assertion which would pass subject validation
          at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:229)
          at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:88)
  ..
  ..
  ..
  Caused by: org.opensaml.xml.validation.ValidationException: Signature is not trusted or invalid
          at org.springframework.security.saml.websso.AbstractProfileBase.verifySignature(AbstractProfileBase.java:272)
          at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertionSignature(WebSSOProfileConsumerImpl.java:419)

Environment

• VMware Cloud Director 10.6.x
• Microsoft Entra ID

Cause

This is due the changes not getting updated on either of the side (vCD or Azure).

Resolution

To update the changes on the other side, please follow the below steps:

1. Regenerate the SAML certificates from vCD Portal ➔ Administration ➔ SAML under Identity Provider ➔ Regenerate Certificates.
2. Download the 'metadata' from the vCD Portal ➔ Administration ➔ SAML under Identity Provider ➔ Edit ➔ Service Provider ➔ Retrieve Metadata. Upload this as-is in Microsoft Azure under 'Upload metadata file'.

3. Download the 'Federated XML Metadata' file from Microsoft Azure portal and upload it as-is in vCD Portal ➔ Administration ➔ SAML under Identity Provider ➔ Edit ➔ Identity Provider ➔ Upload the file.

4. Save the configuration and login back using the SSO account.

Additional Information

Please refer to below document for more information:
Enable Your VMware Cloud Director Organization to Use a SAML Identity Provider
Configure Your VMware Cloud Director System to Use a SAML Identity Provider