No certificates listed in Hub UI for foundation

Products

• VMware Tanzu Platform - Hub

Issue/Introduction

No certificates listed in Hub UI--->Foundation--->Manage--->Certificates

 

The ensemble-stitching logs in tas-hub-collector deployment show that there is no external Group to UAA mappings and token exchange fails between Hub and OPS Manager.

2026-07-24 06:35:06.528 error: trace='-',parent='-',span='-',user='########',org='-',source=-,origin=https://hub.example.com Token exchange error: Failed to perform token exchange: No UAA scopes could be derived: none of the external groups have /Groups/External mappings and no identity zone default groups are available (UAA endpoint: https://opsman.example.com/uaa)

Environment

Tanzu Hub, ERA and OPS Manager integrated with LDAP IDP

Cause

The user that has logged into Hub UI and tried to view the certificates is not part of an LDAP Group that is mapped to a UAA scope with sufficient privileges to view the certificates.

Resolution

LDAP Administrator should verify that the user is part of an LDAP group

Target OPS Man UAA and verify that group is mapped to opsman.admin or opsman.full_view scopes

# uaac target https://opsmgr.example.com/uaa
# uaac token owner get opsman admin -s ""
# uaac group mappings
    resources
      ldap:
      -
        opsman.admin: <LDAP Group>

Map the group to opsman.admin scope

uaac group map <LDAP Group> --name opsman.admin --origin ldap