Recovering Access to vCenter Server after Failed Identity Provider Integration

Products

• VMware vCenter Server

Issue/Introduction

This article provides procedures to recover from authentication redirection loops and 404 errors encountered in vCenter Server following an unsuccessful integration with an external Identity Provider. 

Environment

• VMware vCenter Server 

Cause

• vCenter Server is configured to use an external identity provider (such as Okta) for Single Sign-On (SSO).
• If the federation configuration is misconfigured or fails, any domain-based login attempt triggers the SSO broker to redirect to the external provider endpoint, causing a 404 error or a loop.
• The local [email protected] account is not subject to external identity provider federation, allowing it to bypass this redirection.

Resolution

To regain access to the vCenter Server environment, perform the following steps to bypass the external redirection and revert the identity configuration:

1. Access the vSphere Client URL (e.g., https://<vcenter-fqdn>/ui).
2. Log in using the local [email protected] account.
   • Note: Using this local account avoids the SSO broker redirection associated with domain accounts.
3. Once authenticated, navigate to Administration > Single Sign-On > Configuration.
4. Follow the steps listed in KB below to switch back to Active Directory.
   • How to switch back to Active Directory after configuring vCenter to use Okta
5. Verify that standard authentication functionality is restored by testing a login with your domain credentials.