Tanzu Hub Onboarding Fails with 401 Unauthorized during Org Group Creation
search cancel

Tanzu Hub Onboarding Fails with 401 Unauthorized during Org Group Creation

book

Article ID: 447395

calendar_today

Updated On:

Products

VMware Tanzu Platform Core VMware Tanzu Platform - Hub

Issue/Introduction

When attempting to onboard a Connected Cluster or create an Organization Group within the Tanzu Platform Appliance Hub instance, the process fails with the following error:

Create Org Group failed: Failed to perform token exchange: Response code 401 (Unauthorized)

This typically occurs in environments utilizing an internal user store (UAA) rather than an external Identity Provider (IDP).

Cause

Tanzu Hub requires the administrative user initiating the onboarding (commonly tanzu_platform_admin) to exist in the target foundation's internal user store (EAR UAA) to facilitate token exchange and role synchronization. If the user exists in the Hub UAA but is missing from the foundation's UAA, the foundation will reject the request with a 401 Unauthorized error.

Resolution

The administrative user must be manually created and granted the necessary scopes in the target foundation's UAA.

  1. Log in to the foundation via CF CLI: Ensure you are targeting the foundation where the cluster onboarding is failing.

  2. Create the administrative user: Run the following command to create the user in the foundation: cf create-user tanzu_platform_admin

  3. Grant UAA administrative scopes: Use the uaac tool to grant the necessary permissions for token exchange and role synchronization:

    • uaac target <UAA_ENDPOINT>
    • uaac token client get admin -s <ADMIN_CLIENT_SECRET>
    • uaac member add cloud_controller.admin tanzu_platform_admin
    • uaac member add uaa.admin tanzu_platform_admin
    • uaac member add scim.read tanzu_platform_admin
    • uaac member add scim.write tanzu_platform_admin

  4. Verify User Email: Ensure the email address for tanzu_platform_admin in the foundation's UAA matches the one used in Tanzu Hub (typically [email protected]).

  5. Retry Onboarding: Navigate back to the Tanzu Hub UI and retry the cluster onboarding or organization group creation.

Additional Information

Related articles:

KB 439638: Tanzu Hub failed to create the organization group due to Response code 401 (Unauthorized).

KB 439691: IDP users cannot see capabilities in Tanzu Hub v10.4

KB 442597: Error: No available capabilities found in Tanzu Hub Foundation > Manage tab for attached foundation

 

Powered by Wolken Software