VCF SSO Login Fails with "Access Denied. Unable to authenticate the user" (USER_NOT_FOUND) using Entra ID SAML

Products

• VCF Operations
• VCF Automation
• VMware vCenter Server

Issue/Introduction

When attempting to log in to VMware Cloud Foundation Products using Microsoft Entra ID (SAML) via the VCF SSO, the authentication fails.

The end user experiences the following error on the VCF SSO login screen:

Access Denied. Unable to authenticate the user

 

To verify the issue you must review the vidb pod logs on the VCF Identity Broker appliance. Follow the below steps:

1. SSH into your VCF Identity Broker appliance as vmware-system-user.
2. Locate the vidb pod name by listing all pods in the identity namespace:

   kubectl get pods -A | grep vidb

3. Retrieve the logs for the specific federation service within that pod to look for the USER_NOT_FOUND exception:

   kubectl logs <vidb-pod-name> -n vidb-external | grep "User fetching exception"

Reviewing the vidb pod logs will reveal entries similar to the following, indicating that VCF Identity Broker received an opaque string instead of the actual User Principal Name (UPN):

INFO  vidb-service-##########-#####:federation (federation-business-pool-0) [CUSTOMER;-;X.X.X.X;########-####-####-####-############;-;########-####-####-####-############] com.vmware.vidm.federation.authenticator.saml.SamlAuthenticator - SAML AuthNContext on response: urn:oasis:names:tc:SAML:2.0:ac:classes:Password does not match any auth type on IDP Microsoft Entra ID. Using first auth on IDP.

WARN  vidb-service-##########-#####:federation (ForkJoinPool-2-worker-####) [CUSTOMER;-;X.X.X.X;########-####-####-####-############;-;########-####-####-####-############] com.vmware.vidm.federation.login.processor.AuthResponseUserResolver - User fetching exception with nameId <######string######>, nameIdFormat userPrincipalName, and domains [example.com], user not found

INFO vidb-service-##########-#####:federation (federation-business-pool-0) [CUSTOMER;-;X.X.X.X;########-####-####-####-############;-;########-####-####-####-############] com.vmware.vidm.federation.login.LoginEventServiceAspect - Failing login. contextUuid: ########-####-####-####-############, exception: com.vmware.vidm.federation.login.AccessDeniedException: Access denied with reason code: USER_NOT_FOUND, isAuthenticationForced: false

Environment

• VCF Operations 9.0.x
• VCF Identity Broker 9.0.x
• VCF Automation 9.0.x
• VCF NSX Manager 9.0.x
• VCF Operations for Logs 9.0.x
• vCenter Server 9.0.x

Cause

This issue occurs due to a mismatch in the SAML NameID format expectations between the VCF Identity Broker and Microsoft Entra ID.
If the Name ID Format in the VCF Identity Broker configuration is set to urn:oasis:names:tc:SAML:2.0:nameid-format:persistent, Microsoft Entra ID defaults to sending a privacy-preserving pairwise identifier (a hashed, opaque string such as T9w###W####NN###W95#-4#Nr###i#9-c-T##M##k).
When VCF Identity Broker receives this SAML token, it queries the synced AD/LDAP directory for a user matching that exact opaque string. Because the actual directory stores the readable userPrincipalName (e.g., [email protected]), the lookup fails, resulting in the USER_NOT_FOUND Access Denied error.

Resolution

To resolve this issue, you must align the Name ID format across both the VCF Identity Broker and the Microsoft Entra ID Enterprise Application to ensure the actual User Principal Name (UPN) is passed in the SAML assertion.

 

Follow the steps to update the VCF Identity Broker Configuration:

1. Log in to the VCF Operations Product UI as admin user. (https://<VCF_OPS_FQDN_IP>/ui)
2. In the Left Panel, navigate to Fleet Management > Identity & Access
3. In the middle pane, select the VCF Instance
   
4. Edit the VCF Identity Broker Configuration
5. Locate the Name ID Format setting.
6. Change the value from urn:oasis:names:tc:SAML:2.0:nameid-format:persistent to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   
7. Ensure the Name ID Value remains set to userPrincipalName.
8. Save the VCF Identity Broker configuration.
9. The login should be now successful across all products where VCF SSO is configured.

Additional Information

Configuring Microsoft Entra ID for vCenter Server