VMware SSO login to VCF Automation Organization portal fails with error "Your Single Sign-On attempt failed"

Products

• VCF Automation

Issue/Introduction

When attempting to log in to the VCF Automation Organization portal directly using VMware SSO, users receive a "Your Single Sign-On attempt failed" error. This behavior occurs in environments configured for OpenID Connect (OIDC) integration, preventing authorized users from accessing the specific tenant portal despite valid credentials.

Environment

VCF Automation 9.x

Cause

The issue is caused by an incorrect OIDC Claims Mapping configuration within the Organization's Identity Provider settings. When claims mapping is not correctly aligned with the user attributes (specifically group membership attributes), the authorization check fails during the OIDC handshake for direct portal logins.

Resolution

To resolve this issue, the OIDC Claims Mapping must be corrected to ensure group attributes are properly passed during the authentication handshake.

1. Log in to the VCF Automation Organization Portal.

2. Navigate to Administer > Connections > Identity Providers.

3. Edit and open the OIDC Configuration settings.

4. Navigate to the Claims Mapping section.

5. Validate and correct the mapping for the groups claim. Ensure it matches the attribute syntax expected by the identity provider.

6. Save the changes to the OIDC configuration.

7. Verify access by opening a new browser session in Incognito or Private mode.

8. Navigate directly to the Organization portal URL (e.g., https://<####>/csp/gateway/portal/index.html?tenant=<####>).

9. Attempt a login with an VMware SSO user that is a member of an authorized group.

For more details on the full integration workflow, see VCF Automation Organization integration with OIDC (OpenID Connect) vIDB.