VCF SSO integration shows as not configured and logins fail with HTTP 400 Bad Request after VCF identity broker upgrade
search cancel

VCF SSO integration shows as not configured and logins fail with HTTP 400 Bad Request after VCF identity broker upgrade

book

Article ID: 452420

calendar_today

Updated On:

Products

VCF Operations

Issue/Introduction

Following an upgrade of the VMware Cloud Foundation (VCF) Identity Broker, the VMware Identity Broker (VIDB) configuration for VCF Automation may be reported as 'Not configured' within the VCF Operations user interface. Additionally, Single Sign-On (SSO) logins to vCenter Server and VCF Automation will fail.

When verifying the configuration:

  • In VCF Operations > Manage > Fleet Management > Identity and Access > VCF SSO Overview, the Aria Automation Appliance SSO configuration is displayed as "Not Configured"

  • In the VCF Automation interface > Administration > Identity Providers, the VCF SSO configuration is missing, and only the OIDC configuration is visible.

  • Attempts to log in to the vCenter Server utilizing VCF SSO result in an "HTTP Status 400 - Bad Request" error.

The vcops-bridge.log will display an Identity Provider (IDP) configuration conflict:

ERROR vcfops-bridge #### [ops@#### threadId="####" threadName="DistTaskCurrentConfigEnforcer" operationId=""] [com.vmware.vcops.bridge.server.vidb.configuration.ManagementComponentStateManager.handleVcfaConfiguration] - Error occurred while verifying VCFA auth source
org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request on PUT request for "<VCFA-FQDN>": "{"minorErrorCode":"VCD_50259","message":"A non-vIDB OIDC IDP has already been configured for Systemorg","stackTrace":"com.vmware.vcloud.api.rest.toolkit.exceptions.BadRequestRestApiException: A non-vIDB OIDC IDP has already been configured for System org\n\tat com.vmware.vcloud.api.rest.openapi.impl.vcf.vidb.VidbRegistrationApiHandler.validateNoExistingNonVidbOidcSettings(VidbRegistrationApiHandler.java:167)\n\tat


The ManagementAdapter.log reports secret expiration and endpoint unreachable errors:

ERROR ManagementAdapter #### [ops@#### threadId="####" threadName="TasksManager-TaskHandler-####" instanceId="####"] [(####) com.vmware.adapter.management.components.iam.task.oauthclient.OAuthAppClient.handleRetirePrimarySecret] - Failed to expire secret for client :  org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request on POST request for "<VIDB-FQDN>": "{"errors":[{"code":"oauth2.client.secondary.secret.invalid","message":"OAuth2Client Secondary Secret is either Blank or Invalid for client id ####","parameters":{"name":"####"}}]}"   
ERROR ManagementAdapter #### [ops@#### threadId="####" threadName="TasksManager-TaskHandler-####" instanceId="####"] [(####) com.vmware.adapter.management.components.iam.task.authsource.configurator.VCAuthSourceConfigurator.listAuthSource] - Failed to communicate with vCenter host <VC-FQDN> com.vmware.adapter.management.components.iam.exception.EndpointUnreachable: Cannot contact endpoint <VC-FQDN> at com.vmware.adapter.management.components.iam.client.ApiInvoker.invoke(ApiInvoker.java:101)

Environment

VMware Cloud Foundation (VCF) 9.1
VCF Automation (VCFA) 9.1
VCF Operations (VCFO) 9.1
VCF Identity Broker (vIDB) 9.1.0.0100
vCenter Server 9.1

Cause

  • VCF Operations periodically checks the SSO configuration in vIDB and VCF components to ensure a consistent state. During the upgrade of VCF components, these components are temporarily unavailable. If the periodic check runs during this brief downtime, VCF Operations treats the inability to read the SSO configuration as a failure.
  • To remediate, VCF Operations attempts to reset the secret and update the components with a new secret. The secret reset succeeds because vIDB is reachable, but updating the component fails because the component remains unavailable. Consequently, VCF SSO login fails due to a secret mismatch between vIDB and the VCF component.

Resolution

To resolve the secret mismatch and restore authentication functionality, the configuration must be re-registered on the affected components.

For vCenter Server:

  1. Unjoin the vCenter Server from SSO.

  2. Rejoin the vCenter Server to SSO.

For VCF Automation:

  1. Delete the dangling vIDB integration from VCF Automation.

    Note: When the OIDC configuration is deleted, the user access is lost and old user privileges will be lost. This can be followed during initial setup but in case this is being configured after the solution has been deployed for sometime, inform the customer about the loss of privileges. 

  2. Allow 5 to 10 minutes to pass, then verify that VCF Automation is successfully configured with vIDB

  3. Assign roles to vIDB accounts and groups within VCF Automation.

    Note: This step can be omitted if only native VCF roles are utilized.

Powered by Wolken Software