VCF Operations SSO login fails for specific users after changing NameID format and provisioning type in VIDB

Products

• VCF Operations

Issue/Introduction

• In VMware Cloud Foundation Operations (VCF Operations), single sign-on (SSO) login fails for specific users after altering the Identity Source configuration. While newly provisioned users can log in successfully, existing users experience authentication failures.

• Additionally, attempting to remove or de-provision users and groups under Manage > Identity & Access > VCF SSO Overview > Identity Source > Edit the Directory > Group Provisioning indicates success in the UI, but fails to delete or de-provision the objects from the underlying database.

Environment

VCF Operations 9.1

VIDB 9.1

Cause

The directory provisioning model was changed from Just-In-Time (JIT) to LDAP, and the NameID format was modified from userPrincipalName (UPN) to userName without resetting the SSO configuration. Under JIT, the initial user account was provisioned in VIDB with its full UPN string. When VCF Operations queries the endpoint using the acct claim from the ID token, the format mismatch prevents user resolution.

Resolution

Fix:

• Broadcom has acknowledged this issue and plans to resolve it in an upcoming feature release.

 

Workaround:

Prerequisites:

• Ensure you have administrative access to the VCF Operations UI.

• Take a snapshot or backup of the VCF Operations cluster and the VMware Identity Manager (VIDB) appliance.

Execution Steps:

1. Log into the VCF Operations user interface.

2. Navigate to Manage > Identity & Access > VCF SSO Overview > Identity Source.

3. Click Actions and select Delete SSO to completely remove the existing VCF SSO configuration and purge stale user records from VIDB.

4. Reconfigure the Identity Provider (Entra SAML with LDAP group provisioning) using userName as the NameID format.

5. Reconfigure the Client Configurations for vCenter, NSX, VCF Operations, and VCF Automation across both Provider and Tenant spaces.

6. Reassign the required VCF roles to your designated LDAP groups and user accounts.

7. Verify that all affected users can successfully log in via SSO.