Error: Identity broker encountered an issue during authentication

Products

• VCF Operations

Issue/Introduction

Users in secondary domains experience authentication failures when accessing VCF 9.x components (vCenter, NSX) configured with PingID SAML as the identity provider, while primary domain users authenticate successfully.

• The domains <DOMAIN_1> and <DOMAIN_2> are configured in VCF Operations > Manage > Identity & Access > VCF SSO Overview > Identity Source tab > under Directory Information
  
  
• Users in one of the domains cannot log in to VCF components and see the message:
  
  Error - Identity Broker encountered an issue during authentication. Please contact your VCF Admin with the below details for resolution. Message - You can try again. If this error persists, contact your administrator.
  
  
• The same group name the users are in is used in both domains

• In VCF Identity broker log bundle under /services-logs/vidb-external/<node name>/vidb-service/accesscontrol-service/file-log-##########.log.gz :

  
  YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="federation-business-pool-0" logger="com.vmware.vidm.federation.login.processor.AuthResponseUserResolver" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Fetching user for jit login context: <CONTEXT_ID> on attribute userPrincipalName=<USERNAME@DOMAIN>, domains: [<DOMAIN_1>, <DOMAIN_2>]
YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="federation-business-pool-0" logger="com.vmware.vidm.federation.login.processor.AuthResponseUserResolver" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Creating / updating a JIT user for nameId <USERNAME@DOMAIN>
YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="vertx-http-client-pool-0" logger="com.vmware.vidm.federation.cds.AbstractConfigProvider" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Service federation config item isIPadDetectionEnabled does not exist in CDS
YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="acs-rds-db-ops" logger="com.vmware.vidm.usergroup.service.JitUserServiceImpl" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Creating or Updating user for User ID <USER_ID>, Username <USERNAME>, ExternalId <USERNAME@DOMAIN>, Domain <DOMAIN_1>
YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="acs-rds-db-ops" logger="com.vmware.vidm.usergroup.service.JitUserServiceImpl" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Found existing user for User ID <USER_ID>, Username <USERNAME>, Domain <DOMAIN_1>
YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="usergroup-business-pool-0" logger="com.vmware.vidm.usergroup.service.UserServiceImpl" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Updating User with id: <USER_ID>
YYYY-MM-DDTHH:MM:SS.mmmZ INFO accesscontrol 15 [vidb@4413 threadName="usergroup-business-pool-0" logger="com.vmware.vidm.usergroup.model.business.User" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] User with Id <USER_ID> has an update for externalId which will be ignored
YYYY-MM-DDTHH:MM:SS.mmmZ ERROR accesscontrol 15 [vidb@4413 threadName="acs-rds-db-ops" logger="com.vmware.vidm.usergroup.datastore.AbstractRdsDataService" opId="########-####-####-####-############-" tenantId="CUSTOMER" scPath="vidb/APPLIANCE"] Unexpected exception org.springframework.dao.IncorrectResultSizeDataAccessException: Query did not return a unique result: 2 results were returned
  
  

Environment

• VCF Operations 9.1.0
• Identity broker 9.1.0
• PingID

Cause

When the same group name is used in multiple domains, users in the secondary domain cannot log in. 

Resolution

This is a known issue and will be fixed in a future release of VCF Operations. 

Workaround

1. Create a new group in PingID with a different name in the domain that fails to log in, with the same user membership. 
   
   
2. Reconfigure Identity broker to use the new group instead of the group with the same name as the other domain group. See: Edit the Configuration of an Identity Provider

Additional Information

• Subscribe to this Knowledge Base article to get updated when VCF Operations release with the fix comes out: Subscribe to a Broadcom knowledge article by article or product
  
  
• To generate an Identity broker log bundle, see: Support Bundle Actions for VCF Automation and VCF Services Runtime