vCenter Server login fails with "Access Denied" when using PingFederate SCIM provisioning

Products

• VMware vCenter Server

Issue/Introduction

• After configuring PingFederate as an External Identity Provider with SCIM provisioning, authentication attempts fail. The vSphere Client displays the error:
  
  Unable to login because you do not have permissions on any of the vCenter Server systems.


• The following error is observed in /var/log/vmware/vpxd/vpxd.log:
  
  ERROR lro-######## -- vim.SessionManager.loginByToken -- vim.fault.NoPermission


• The /var/log/vmware/usergroup-service/usergroup-service-1.log contains a specific exception during SCIM operations:
  
  io.vertx.ext.web.RoutingContext - RoutingContext failure (500) com.vmware.vidm.common.vertx.exceptions.WebApplicationException: INTERNAL_SERVER_ERROR
...
Caused by: java.lang.IllegalArgumentException: Invalid UUID string: <<USER NAME>>
      at com.vmware.vidm.usergroup.resource.scim2.GroupScimResource.lambda$patchGroup$19(GroupScimResource.java:472) 
  
  

Environment

• VMware vCenter Server 8.0U3
  
  
• PingFederate with SCIM 2.0 Outbound Provisioning

Cause

The issue occurs because the PingFederate SCIM provisioner passes a literal username string instead of a valid internal UUID in the SCIM PATCH payload for group memberships.The vCenter Server internal identity database expects a UUID format for user references within groups. When a non-UUID string is received, the process fails, and group-based permissions are not applied to the user.

Resolution

To resolve this issue, the User Filter in PingFederate must be updated to correctly map user identities:

1. Log in to the PingFederate Admin Console.

2. Navigate to Outbound Provisioning > Channels.

3. Select the channel configured for vCenter Server and go to Target Configuration.

4. Find the User Filter field.

5. Change the entry from externalId eq "%s" to userName eq "%s".

6. Confirm that the Unique User Identifier is set to userName.

7. Save the configuration and wait for the next synchronization cycle.

8. Log in to vCenter Server using the full UPN format (e.g., <<USER NAME>>@example.com).

Additional Information

Ensure that all users are members of the Active Directory groups specified in the PingFederate "Push Groups" configuration. For further details on certificate requirements, refer to Knowledge Base Article 408234.