Stale VCF SSO Identity Provider removal fails with "Insufficient privileges" despite using Local SSO Administrator credentials

Products

• VCF Operations
• VMware vCenter Server

Issue/Introduction

• Following the decommissioning of an External/Embedded vIDB, a vCenter Server incorrectly retains an active OIDC federation state with VCF SSO. The vSphere Client UI lacks native options to remove the Identity Provider.

• Attempting to manually delete the identity provider using the vCenter REST API via Developer Tools (DELETE https://vCenter-fqdn/api/vcenter/identity/providers/CUSTOMER) will experience a severe authorization denial. Notably, executing this DELETE operation while explicitly authenticated as [email protected] in Developer Tools still fails, returning the following JSON error response:

  {
    "args": [ ], 
    "default_message": "Insufficient privileges. Contact the Administrator to get the required privileges.", 
    "id": "com.vmware.vapi.authorization.permission.denied"
  }

Environment

• VMware Cloud Foundation (VCF) Operations 9.x
  
  
• VMware vCenter Server 9.x

Cause

The vCenter Server retains an active integration connection with VCF Operations (VCFOPS) utilizing a restricted Service Account credential. This active integration binding locks the Identity Provider configuration and inherits the permissions of the bound service account. Consequently, the vCenter authorization framework explicitly rejects structural mutations to the Identity Provider, blocking manual API deletion requests even when the Developer Tools session is initiated by a local SSO administrator.

Resolution

To successfully purge the stale VCF SSO Identity Provider object from the vCenter database without authorization blocks, the session context maintained by the VCFOPS engine must be temporarily elevated to a global administrator account, and then reverted to maintain least-privilege security.

1. Temporarily Elevate VCF Operations Integration Credentials
   1. Log in to the VCF Operations 9.1.x user interface with administrative privileges.
   2. On the VCF Operations navigation bar at the top, click Operate.
   3. In the left navigation pane, click Administration > Integrations.
   4. Locate and select the configured vCenter Server account associated with the vCenter.
   5. Edit the vCenter connection endpoint configuration.
   6. In the credentials section, modify the credential binding by replacing the existing restricted Service Account credentials with the local SSO administrative account ([email protected]) and its associated password.
   7. Validate the connection to ensure VCF Operations can successfully authenticate with the newly elevated privileges, then save the configuration.
2. Remove VCF SSO Identity Provider via vCenter Developer Center
   1. Log in to the vSphere Client of the vCenter Server using the [email protected] account.
   2. From the vSphere Client main menu, navigate to Developer Center and select the API Explorer tab.
   3. From the Select API dropdown menu, ensure vCenter is selected.
   4. Expand the identity/providers API section.
   5. Locate and expand the DELETE /api/vcenter/identity/providers/{provider} endpoint.
   6. Click Execute (or Try it out) and enter exactly CUSTOMER into the {provider} string parameter field.
   7. Execute the API call. The server should return a successful response code (e.g., 204 No Content or 200 OK), confirming the IDP was successfully deleted.
3. Verify Deletion
   1. While still within the API Explorer > identity/providers section, locate and expand the GET /api/vcenter/identity/providers endpoint.
   2. Click Execute to retrieve the list of active identity providers.
   3. Review the returned JSON payload to confirm that the VCF SSO Identity Provider object is no longer listed in the database.
4. Restore Least-Privilege Access in VCF Operations
   1. Return to the VCF Operations 9.1 interface.
   2. On the VCF Operations navigation bar at the top, click Operate.
   3. In the left navigation pane, click Administration > Integrations.
   4. Select the vCenter Server account and edit the configuration.
   5. Revert the credentials configuration back to the original restricted Service Account used prior to this procedure.
   6. Validate the connection and save the configuration to restore standard least-privilege operations.