Cannot login to Tanzu Mission Control (TMC) - errcode: 3012 errmsg: Forbidden

Products

• VMware Tanzu Mission Control

Issue/Introduction

When logging into Tanzu Mission Control (TMC), the landing page shows the following error:

errcode: 3012 errmsg: Forbidden requestId: <request Id>

Environment

Tanzu Mission Control Self-Managed

Cause

The user you are logging in as has been detected by the system to not be in the Identity Provider's (IDP) admin group for Tanzu Mission Control Self-Managed (TMC-SM).

This admin group for TMC is defined in the idpGroupRoles of the values.yaml used to install TMC-SM.

Identity Provider components have case-sensitivity and can cause the same error if the casing for the defined admin group in the TMC values.yaml does not match the IDP's admin group casing.

Resolution

You will need to check the admin group configured with your Tanzu Mission Control Self-Managed (TMC-SM) install and confirm that the user you are using to login is a part of that admin group in your Identity Provider (IDP).

 

You can validate the user and group that the latest login attempt used with the below steps:

1. Connect into the cluster context with the tmc-local namespace that is running TMC-SM
   
   
2. List pinniped token secrets that are generated with each login attempt:
   

   kubectl get secret -n tmc-local | grep "pinniped-storage-access-token"

    

3. Decode the latest pinniped token secret to see the username and group that was used in the attempt:
   

   kubectl get secret -n tmc-local -o jsonpath='{.data.pinniped\-storage\-data}' <latest pinniped-storage-access-token secret> | base64 -d

    

4. Confirm that the output username and group match what was used in the values.yaml for installing TMC-SM.

 

The current propagated configuration from the last applied values.yaml can be found in the following steps:

1. Connect into the cluster context with the tmc-local namespace that is running TMC-SM
   
   
   
2. Decode the current configuration from the last applied values.yaml:
   

   kubectl get secret -n tmc-local tanzu-mission-control-tmc-local-values -o jsonpath='{.data.values\.yaml}' |base64 -d

    

3. Check that the idpGroupRoles matches the admin group in your Identity Provider.
   NOTE: These values are case-sensitive and must match case with your Identity Provider.

 

If you need to make updates to the values.yaml configuration applied to your TMC-SM instance, use the below tmc-sm CLI command with your updated values.yaml file:

tmc-sm update --values-file <updated values.yaml file>

 

If you encounter the below error message, in TMC-SM v1.4.3 and higher the claimsUsername is no longer a field that is automatically applied to your OIDCIdentityProvider and you must update your values.yaml to include it:

unprocessable entity: required claim in upstream ID token missing

Additional Information

Tanzu Mission Control Self-Managed Configuration Key Values