Unable to Connect to Entra ID via Proxy in VCF Automation VM-Apps Tenant

Products

• VCF Automation

Issue/Introduction

While attempting to configure an Identity Provider (IdP) for a VM-Apps tenant within VCF Automation, the connection to Entra ID (login.microsoftonline.com) fails when routed through an outbound proxy.

The following error is observed in the logs or user interface:

"ERROR - Unable to establish connection: java.io.IOException: Unable to tunnel through proxy. Proxy returns 'HTTP/1.1 407 Proxy Authorization Required'"

Environment

• VCF Automation 9.X

Cause

The connection fails because the outbound proxy requires authentication credentials that are not being processed for direct Identity Provider (IdP) traffic.

Resolution

If your organization requires outbound IdP traffic to route strictly through an authenticated proxy and bypassing it is not an option, please open a new ticket with the Broadcom Support Ticket to investigate the issue further.

Workaround:

Add all VCF Automation (VCFA) node IP addresses and FQDNs to the proxy bypass/exception list on your proxy server or network environment to allow direct traffic to the IdP.

To verify network connectivity through the proxy, run the following curl command from the VCFA node:

curl -kv https://login.microsoftonline.com --proxy http://<Proxy_IP>:<Port>

Note: Replace <Proxy_IP> and <Port> with your specific proxy server details (e.g., 8080).