Error "400 Bad Request" while logging in to vCenter server via domain users in a Microsoft ADFS MFA setup

Products

• VMware vCenter Server

Issue/Introduction

 

• Accessing the vSphere Client URL https://VC_FQDN/ redirects normally to the login portal.

• Selecting 'Microsoft ADFS' as the external identity provider successfully routes the request to the active ADFS server endpoint.

• After providing valid user credentials and the required Multi-Factor Authentication (MFA) code, the browser redirects back to the vCenter Server but displays a 400 Bad Request error page.

• In the /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log file, the following error signatures are captured, indicating an authorization grant issue due to a missing UPN claim:


  id = com. vnware. vcenter. tokenservice.exceptions InvalidGrant,
defaultMessage = Subject is missing
args = []

   

 

Environment

VMware vCenter Server 8.x

VMware vCenter Server 9.x

Cause

This issue occurs when the User Principal Name (UPN) claim is missing in the access token returned by the external Microsoft ADFS identity provider server, or if there is an underlying configuration issue on the ADFS server side.

Resolution

Verify the configured claim rules on the ADFS server, paying specific attention to the configuration of the User Principal Name (UPN) rule mapping.

Additionally, please check if the ADFS configuration meets requirements and verification steps as outlined in the article here: How to enable OpenID Connect in ADFS 2016 for vCenter Server