"HTTP Status 400" is observed when trying to login vCenter using SSO - VCF 9.1.0

Products

• VMware vCenter Server
• VCF Operations

Issue/Introduction

• In a VCF 9.1 environment, vCenter login via VIDB SSO account fails with an "HTTPS Status 400 - Bad Request" error. While SSO configuration works for other components like VCF Operations, it fails specifically for the vCenter appliance.
• Following logs are observed in /var/log/vmware/trustmanagement/trustmanagement-svcs.log and /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log:

trustmanagement-svcs.log:

<YYYY-MM-DD>T<HH:MM:SS> WARNING trustmanagement-svcs ## [vc@#### threadName="pool-#-thread-#" logger="com.vmware.iam.txaz.client.VidbClient"] Caught exception while fetching the client ########-####-####-####-############ details
java.lang.RuntimeException: Failed to get the access token.
        at com.vmware.iam.txaz.client.VidbClient.getClientAccessToken(VidbClient.java:###)
        at com.vmware.iam.txaz.client.VidbClient.getOAuthClient(VidbClient.java:###)
        at com.vmware.iam.txaz.secretrotation.ClientSecretRotator.lambda$initSecretRotationTask$0(ClientSecretRotator.java:##)

vsphere_client_virgo.log:

<YYYY-MM-DD>T<HH:MM:SS> ERROR vsphere-ui ##### [vc@#### threadName="http-nio-127.0.0.1-####-exec-###" logger="com.vmware.skyscraper.oauth2.common.Oauth2Helper" ######## ###### ###### ] Exception while exchanging token with csp with for code <CODE> and state ########-####-####-####-############. Csp responded with status 401 UNAUTHORIZED  and body {"error":"invalid_client","error_description":"oauth2.authorization.credentials.invalid"}

Environment

VCF 9.1.0

Cause

• This issue occurs when the client credentials used by the vCenter's OAuth2 client become invalid or expire.
• As a result, the vCenter fails to obtain an access token to complete the client secret rotation.
• During the login operation, the UI fetches outdated provider information from the Trust Management Service (TMS), causing the authentication workflow to fail with an "invalid_client" error.
• See details in KB vCenter Login Failure with Error "[400] Unable to authenticate. Check your credentials. If problem persists, contact your administrator." in VCF 9.x

Resolution

Note: Either the following procedure or "Method 2: Manually rotate the VC's OAuth2 client secret and then patch the IDP configuration with the new secret." may be used to resolve this issue.

Refresh the OAuth2 client registration and credentials by unjoining and rejoining the SSO domain for the vCenter appliance.

1. In the VCF Operations navigation bar at the top, click Manage.
2. In the left navigation pane, click Fleet Management > Identity & Access.
3. In the Identity & Access pane, click VCF SSO Overview.
4. In the VCF SSO Overview page, select the identity broker under VCF SSO, then under the Component Configuration tab, select the affected vCenter appliance from the data grid.
5. Click the horizontal ellipsis (...) and select Unjoin SSO.
6. Once the process completes, click on the check box( vCenter) of the component, then click the horizontal ellipsis (...) and select Rejoin SSO.
7. The vCenter will rejoin the SSO and it will again be possible to log into the vCenter using VCF SSO.