Logout redirect URL incorrectly points to Identity Broker FQDN in VCF Automation

Products

• VCF Operations
• VCF Automation

Issue/Introduction

• Users logging out of VCF Automation (VCFA) using Fleet IDB (vIDB) for Single Sign-On (SSO) land on a blank vIDB FQDN page instead of the expected Tenant Portal login page.

• Post-logout, the browser may display the following error:

  {"errors":[{"code":"oidc.logout.invalid.redirect.uri","message":"Invalid logout redirect URL specified.","parameters":{}}]}

Environment

• VMware Cloud Foundation Automation (VCFA) 9.1

• Identity Broker (vIDB)

Cause

The configured 'postLogoutRedirectUri' value in VCFA does not match the value set in the "Post Logout Redirect URI's" field on the vIDB side for the tenant SSO configuration. The invalid redirect URL error is triggered when processing the end-session request due to this mismatch.

Resolution

1. Navigate to the OIDC configuration for the tenant in VCFA.

2. Click Edit. Open the browser developer tools and navigate to the Network tab, then click Save.

3. Observe a 'testconnection' call followed by an 'oauth' call in the Network tab. The 'oauth' call will be a PUT request to 'api/admin/org/{{orgid}}/settings/oauth'.

4. Right-click on the oauth request, select Copy, and choose Copy as cURL.

5. Paste this cURL command into a text editor.

6. Search the string for "postLogoutRedirectUri". If the value is 'null', populate it with the correct FQDN redirect string (e.g., https://<automation-fqdn>/login/?service=tenant:VM-Apps-Org).

7. Copy the entirety of the modified cURL command and execute it from a command-line interface to update the VCFA configuration.

8. Update the "Post Logout Redirect URI's" field within the vIDB configuration so that it exactly matches the new "postLogoutRedirectUri" value specified in the VCFA OIDC settings.

Additional Information

Note: Refreshing the page may display an "upstream connect error or disconnect/reset before headers. reset reason: connection termination" message due to a known issue. This does not affect your configuration change and will be resolved in a future release. 

To subscribe to this article refer to Subscribe to a Broadcom knowledge article by article or product