"HTTP Status 400" is observed when trying to login vCenter using SSO - VCF 9.1.x

Products

• VMware vCenter Server
• VCF Operations

Issue/Introduction

• In a VCF 9.1.x environment, vCenter login via VIDB SSO account fails with an "HTTPS Status 400 - Bad Request" error. While SSO configuration works for other components like VCF Operations, it fails specifically for the vCenter appliance.
• Following logs are observed in /var/log/vmware/trustmanagement/trustmanagement-svcs.log and /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log:

trustmanagement-svcs.log:

<YYYY-MM-DD>T<HH:MM:SS> WARNING trustmanagement-svcs ## [vc@#### threadName="pool-#-thread-#" logger="com.vmware.iam.txaz.client.VidbClient"] Caught exception while fetching the client ########-####-####-####-############ details
java.lang.RuntimeException: Failed to get the access token.
        at com.vmware.iam.txaz.client.VidbClient.getClientAccessToken(VidbClient.java:###)
        at com.vmware.iam.txaz.client.VidbClient.getOAuthClient(VidbClient.java:###)
        at com.vmware.iam.txaz.secretrotation.ClientSecretRotator.lambda$initSecretRotationTask$0(ClientSecretRotator.java:##)

vsphere_client_virgo.log:

<YYYY-MM-DD>T<HH:MM:SS> ERROR vsphere-ui ##### [vc@#### threadName="http-nio-127.0.0.1-####-exec-###" logger="com.vmware.skyscraper.oauth2.common.Oauth2Helper" ######## ###### ###### ] Exception while exchanging token with csp with for code <CODE> and state ########-####-####-####-############. Csp responded with status 401 UNAUTHORIZED  and body {"error":"invalid_client","error_description":"oauth2.authorization.credentials.invalid"}

Environment

VCF 9.1.x

Cause

• This issue occurs when the client credentials used by the vCenter's OAuth2 client become invalid or expire.
• As a result, the vCenter fails to obtain an access token to complete the client secret rotation.
• During the login operation, the UI fetches outdated provider information from the Trust Management Service (TMS), causing the authentication workflow to fail with an "invalid_client" error.
• See details in KB vCenter Login Failure with Error "[400] Unable to authenticate. Check your credentials. If problem persists, contact your administrator." in VCF 9.x

Resolution

Note: For the Workload domain the following procedure may be used to resolve this issue.

• For the Management domain vCenter, steps from Method 1 or 2 of KB vCenter Login Failure with Error "[400] Unable to authenticate. Check your credentials. If problem persists, contact your administrator." in VCF 9.x are required. Steps in that same KB can be used for the Workload domain as stated within it if the steps below do not resolve the issue.
  
  

Refresh the OAuth2 client registration and credentials by unjoining and rejoining the SSO domain for the vCenter appliance.

1. In the VCF Operations navigation bar at the top, click Manage.
2. In the left navigation pane, click Fleet Management > Identity & Access.
3. In the Identity & Access pane, click VCF SSO Overview.
4. In the VCF SSO Overview page, select the identity broker under VCF SSO, then under the Component Configuration tab, select the affected vCenter appliance from the data grid.
5. Click the horizontal ellipsis (...) and select Unjoin SSO.
6. Once the process completes, click on the check box( vCenter) of the component, then click on the "CONFIGURE COMPONENT".
7. The vCenter will rejoin the SSO and it will again be possible to log into the vCenter using VCF SSO.