Invalid Issuer in Token JWT Validation Failed Accessing Software Depot in VCF Operations

Products

• VCF Operations

Issue/Introduction

An error is observed while accessing the Software Depot from VCF Operations. The user interface displays a JWT expired token error with the following message:

"Invalid issuer in token. JWT issuer is absent in token or does not match supported token issuers. Retry with a fresh token. If issue persists, contact Broadcom Support."

Additionally, log analysis reveals repeated ConnectTimeoutException: Connection timed out and JWTValidationException: Invalid issuer in token errors when attempting to communicate with the identity token endpoint.

Environment

VCF Operations 9.1

VMware SDDC Manager 9.1

Cause

The issue is caused by a network connectivity timeout over HTTPS port 443. The component manager plugin fails to communicate with the SDDC Manager endpoint, preventing the download service from synchronizing the trusted issuers list. Consequently, authentication tokens are rejected due to a missing or unmatched JWT issuer.

Resolution

• Log in to VCF Operations and navigate to Integrations > Accounts > VCF Adapter to check the collection status for the problematic SDDC.
  
  
• Identify the specific collector node (e.g., Cloud Proxy) assigned for collection to this SDDC.
  
  
• Test TCP port 443 reachability directly from the assigned collector node to the SDDC endpoint by running the following command via CLI: curl -vk https://<REDACTED_HOSTNAME>:443
  
  
• Update the network firewall rules to open port 443 from the cloud proxy to the SDDC Manager.
  
  
• Retry the connection to the Software Depot to verify the issue is resolved.

 

Additional Information

For further guidance on port requirements and configuring adapters, please review the VCF Operations Product Documentation.