Error "Saving configuration settings failed with the following error: Failed to retrieve OIDC endpoints from configuration url: https://login.microsoftonlne.com/####/v2.0/.well- known/openid-configuration" while configuring VCF-SSO with Entra-ID

Products

• VCF Operations

Issue/Introduction

• While configuring VCF-SSO with Entra ID as IDP in VCF Operations 9.1, it fails with the error as below:
  
  
• Test connectivity from VIDB in VMSP cluster fails with Error 503

idmservice$ curl -v -- max-time 30 -x http://proxy-service.vmsp-#####.s##.c###.local:3128 https://login.microsoftonline.com

Host proxy-service.vmsp-#####.s##.c###.local:3128 was resolved.
IPv6: (none)
IPv4: 198.##.##.##
Trying 198.##.##.##:3128 ...
CONNECT: no ALPN negotiated
allocate connect buffer
Establish HTTP proxy tunnel to login.microsoftonline.com: 443
CONNECT login.microsoftonline.com: 443 HTTP/1.1
Host: login.microsoftonline.com:443
User-Agent: curl/8.19.0
Proxy-Connection: Keep-Alive

HTTP/1.1 503 Service Unavailable
Server: squid/6.12
Mime-Version: 1.0
Date: ###### GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3614
X-Squid-Error: ERR SECURE CONNECT FAIL 0
Vary: Accept-Language
Content-Language: en

CONNECT tunnel failed, response 503
closing connection #0
url: (56) CONNECT tunnel failed, response 503

• Proxy Configuration in below Management Plane has the below configuration:
  
  

root@<Controlplane> [ ~ ]# kubectl get deploy proxy-service -n vmsp-platform -o json | jq '.spec. template. spec. containers [0] .env'

"name": "HOST",
"value": "<Proxy fqdn/IP>"

[

"name": "PORT"
"value": "9090"

"name": "EXCLUDE IP ADDRESSES",
"value": "127.0.0.1, #####"

'name": "EXCLUDE DOMAINS",
"value": "localhost,.<Domain Name>"

"name": "READ TIMEOUT",
"value": "15"

"name": "CREDENTIALS ENABLED"
"value": "false"

I

'name": "TLS ENABLED"
"value": "true"

Environment

VCF Operations 9.1

Cause

vIDB is unable to retrieve the OIDC discovery endpoint through the proxy, as the custom proxy configured in the environment ran over HTTP, but VMSP proxy-service was configured to connect to it over HTTPS (TLS_ENABLED=true).

Resolution

• Disable TLS in vIDB Proxy configuration (For more details refer Configure a Proxy Server for VCF Management Services Components and VCF Automation )