UPN suffix users fail to login to VCF Operations 9.1 with "Failed to log in with VCF SSO service"
search cancel

UPN suffix users fail to login to VCF Operations 9.1 with "Failed to log in with VCF SSO service"

book

Article ID: 447935

calendar_today

Updated On:

Products

VCF Operations

Issue/Introduction

  • AD Users with a UPN suffix (e.g., <username>@<UPNsuffix>) fail to login to VCF Operations 9.1, however same users are successfully able to login to other Management components like SDDC Manager, vCenter. The VCF Operations UI displays the following error message:

    Failed to log in with VCF SSO service. The user did not import or does not belong to any imported group

  • Even though the login on VCF Operations fails, the VIDB service logs show that authentication is successful , post which it re-routes to the VCF Operations (Refer to Additional Information section for steps to generate and navigate to VIDB service logs)

    vidb-external\vsp-####\vidb-service-####-####\vidb-service\console-log-####.log

    YYYY-MM-DDThh:mm:ss stdout F YYYY-MM-DDThh:mm:ss INFO accesscontrol 15 [vidb@4413 auditID="login" subject="<username>@<UPNsuffix>" object="####-####-####-####" origin="@component" result="success" baseType="Action" uuid="####-####-####-####" timestamp="####" tenantId="CUSTOMER" actorDomain="<DOMAIN>" actorUuid="####-#####-####-####" deviceId="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36" value="{\"isForceAuth\":\"false\",\"tokenId\":\"####-####-####\",\"successAuthMethods\":\"EmbeddedIdp_####\",\"success\":\"true\",\"destination\":\"https://<VIDB_FQDN>/acs/t/CUSTOMER/authorize?response_type=code&client_id=####-####-####-####&redirect_uri=https%3A%2F%2F<VCF_OPS_FQDN>%2Fui%2FvidbClient%2Fvidb%2F&state=dmNmb3BzMS52Y2YubGFi\",\"authMethods\":\"LDAP\",\"actorExternalId\":\"####-####-####-####\"}" scPath="vidb/APPLIANCE"]
    YYYY-MM-DDThh:mm:ss stdout F YYYY-MM-DDThh:mm:ss INFO accesscontrol 15 [vidb@4413 threadName="vertx-generic-handler-pool-0" logger="com.vmware.vidm.accesscontrol.model.validator.RedirectUrlValidator" opId="####-####-####-####" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] [isValid] url : https://<VCF_OPS_FQDN>/ui/vidbClient/vidb/ , valid : true

  • The same user is able to successfully login to  VCF Operations with <username>@<DOMAIN_FQDN> format

  • This issue may occur after configuring the Identity Provider (IDP) and changing the Active Directory search attribute mappings from sAMAccountName to userPrincipalName.

Environment

VCF Operations 9.1

Resolution

This is a known issue with VCF Operations 9.1.0 will be resolved in a future release of VCF Operations. To workaround this, perform the following steps to remove the current IDP and configure the IDP afresh while ensuring the below steps:

  1. Map the directory search attribute to userPrincipalName while configuring the LDAP bind.

  2. During Attribute Mappings, map both userName and userPrincipalName to userPrincipalName.

  3. Leave all other attribute mappings at their default values

Additional Information

To retrieve the vidb-service logs follow either of the below methods:

  1. Offline method: Generate Support bundle for VCF Identity Broker

    1. Login to VCF Ops using admin and navigate to Build > Lifecycle > VCF Management > Component > Identity Broker > Actions > Generate support bundle and then Download support bundle

    2. Extract the bundle and navigate to  vcf-bundle-####-####_extracted\services-logs\vidb-external\vsp-####\vidb-service-####-####\vidb-service\console-log-####.log

  2. Online method: Review the logs for vidb service container:

    1. Login to one of the Mgmt services node using vmware-system-user

    2. Elevate to root:

      sudo -i

    3. Find the Control plane node:

      if [ -f /etc/kubernetes/manifests/kube-apiserver.yaml ]; then echo -e "\n This is a CONTROL PLANE node"; else echo -e "\n This is a WORKER node"; echo " Control Plane Endpoint: $(sudo grep 'server:' /etc/kubernetes/kubelet.conf 2>/dev/null | awk -F'/' '{print $3}')"; fi

    4. SSH to the control plane node using same user credential and set kubeconfig:

      export KUBECONFIG=/etc/kubernetes/admin.conf

    5. Check the vidb pod details to get the vidb-service pod name

      k get pods -A | grep -i vidb

    6. From the above output, get the vidb-service pod name and check the logs for vidb-service container inside it:

      k logs -n vidb-external vidb-service-####-#### -c vidb-service |less
Powered by Wolken Software