Unable to search or add ADFS users or groups in NSX despite successful IDP connection.

Products

• VMware NSX

Issue/Introduction

• You are unable to search for or add ADFS users and groups within the VMware NSX UI.
• The search returns "No items found" even when you enter the exact name of a known principal.
  
• The Identity Provider (IDP) connection status shows as successful.
• Configuration scripts for connecting NSX to vCenter have executed without error.
• vCenter successfully authenticates the same ADFS users and they are visible in vSphere Global Permissions.

Environment

VMware NSX 4.2.x
vCenter Server with external ADFS Identity Provider

Cause

The issue typically occurs because the LDAP search scope defined in the NSX Identity Source configuration is too restrictive. Even if the OIDC token flow is functional, NSX uses an LDAP bind to query the directory for users and groups. If the base_dn is set to a specific Organizational Unit (OU) rather than the root of the domain, or if there is a mismatch between the domain_name and the base_dn, the search query fails to locate the principals.

Resolution

Follow these steps to verify and update the configuration

1. Log in to the NSX Manager UI with administrator privileges.
2. Navigate to System > User Management > Authentication Providers > LDAP.
3. Locate the configured Identity Source and click Edit.
4. Verify the Base DN and Domain Name fields.
5. Ensure that the domain_name and base_dn are identical (for example, if the domain is ####.com, the Base DN should be DC=####,DC=com).
6. Remove any specific Organizational Units (OUs) from the Base DN string to provide a broad search root.
7. Click Save.
8. Attempt to search for the user or group again in the NSX UI.

If the search still fails to return results, you can open a support request with the Broadcom, see Creating and managing Broadcom cases

Additional Information

Reference doc:  https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-2/administration-guide/authentication-and-authorization/integration-with-ldap/ldap-identity-source.html