Error: Authentication failure when logging in with an SSO account. VMware Cloud Director Availability

Products

• VMware Cloud Director
• VMware Cloud Director Availability - Disaster Recovery 4.x
• VMware Cloud Director Availability - Migration 4.x

Issue/Introduction

When attempting to log into any VMware Cloud Director Availability (VCDA) appliance UI using a vCenter Single Sign-On (SSO) account, the login fails with an authentication error.

• Logging into the VCDA appliance UI with an 'SSO login' type fails with Authentication failure or Permission denied.
• The issue is commonly observed in restricted environments and public cloud offerings like Azure VMware Solution (AVS) where default SSO group permissions are limited.

Environment

• VMware Cloud Director Availability 4.x
• VMware vCenter Server 8.x
• Azure VMware Solution (AVS)

Cause

VCDA requires users to be members of specific SSO groups to authenticate against the management domain, Administrators or VrAdministrators. In many environments, standard vCenter Global Permissions do not grant the necessary Single Sign-On privileges. If the built-in Administrators group cannot be modified, the VrAdministrators group must be present.

Resolution

Perform the following steps to ensure the SSO account has the required group memberships:

1. Log into the vSphere Client as a user with SSO administrator privileges.
2. Navigate to Administration > Single Sign-On > Users and Groups.
3. Select the Groups tab and search for the Administrators group.
4. If permitted, add the impacted SSO user or group to the Administrators group
   
   OR
   
   If the Administrators group cannot be modified (common in restricted environments):
   1. Click Add to create a new group.
   2. Set the Group Name to: VrAdministrators
   3. Set the Identity Source to the local SSO domain (e.g., vsphere.local).
   4. Add the required SSO users or groups to this new VrAdministrators group.
   5. Click Save.
5. Attempt to log into the VCDA appliance again with the SSO account.

Additional Information

• For more information on user sessions and security requirements, refer to the VMware Cloud Director Availability Security Guide.
• For more information on logging in as a provider, refer to Log in to VMware Cloud Director Availability as a provider.
• Verify NTP synchronization between vCenter and the VCDA appliance, as time skew will cause SSO authentication to fail.
• See Contact Broadcom Support if login issues persist after ensuring group membership.