Error "oauth2.request.invalid.redirecturl" when logging into HCX Manager via VCF SSO

Products

• VCF Operations
• VMware HCX

Issue/Introduction

Symptoms

• The HCX Manager login fails when using Single Sign-On (SSO).
• The authentication process fails through the VCF Identity Broker.
• The web browser displays the following error message: Error: VCF Identity Broker encountered an issue during authentication. Message: Invalid redirect URL specified in authorize request. Error Code: oauth2.request.invalid.redirecturl


Environment

VMware HCX 9.#

VCF Operations 9.#

Cause

• This issue occurs because the OAuth2 secret used by the HCX Manager is out of sync with the VCF Operations component configuration.
• The VCF Identity Broker strictly enforces security by cross-referencing the redirection request against a pre-registered whitelist; if the secret to the redirect URLs do not align, the broker rejects the authentication request.

Resolution

To resolve this issue, the HCX secret must be regenerated and synchronized within the VCF environment:

1. Regenerate the Secret in VCF Operations:

   • Log in to the VCF Operations user interface.
   • Navigate to Fleet Management > Lifecycle > VCF Management > Components.
   • Locate and select the HCX component.
   • Select the option to REGENERATE the secret. Copy the new secret value.

2. Update the HCX Manager Configuration:

   • Log in to the HCX Manager appliance management interface at https://<HCX-Manager-IP-or-FQDN>:9443.
   • Navigate to the Configuration tab.
   • Select VCF SSO from the menu and click edit.
   • Paste the new secret generated in Step 1 into the secret field.
   • Click Submit to save the changes.

3. Verification:

   • Attempt to log in to the HCX Manager UI using VCF SSO to confirm that the authentication handshake now completes successfully.