Troubleshooting Tanzu Hub User and Role Synchronization Issues
search cancel

Troubleshooting Tanzu Hub User and Role Synchronization Issues

book

Article ID: 452897

calendar_today

Updated On:

Products

VMware Tanzu Application Platform VMware Tanzu Platform - Hub VMware Tanzu Platform - Cloud Foundry

Issue/Introduction

The Tanzu Hub synchronization agent (collector) uses specific filtering logic. A user is excluded from synchronization if they do not meet the following criteria:

  1. Missing Role Binding: The user must have at least one active, supported role (e.g., SpaceDeveloper, OrgManager) assigned within the connected foundation.
  2. Missing Email Attribute: The user account in the foundation's identity store (UAA) must have a valid email address populated in either the username or email field.
  3. Shadow User Creation: For OIDC-configured foundations, shadow users are only created in Hub's UAA after their first successful login to Tanzu Hub.

Resolution

To ensure users synchronize successfully and assume the correct roles, follow these steps:

1. Verify User Roles

Use the Cloud Foundry CLI to confirm the user has an assigned role in the relevant Org and Space:

cf space-users <ORG_NAME> <SPACE_NAME>

If the user is missing, assign the required role:

cf set-space-role <USERNAME> <ORG_NAME> <SPACE_NAME> SpaceDeveloper

 

2. Validate Email Attribute

Synchronization requires an email address. If using the internal UAA store, ensure the account has an email populated. For accounts where the username is not an email (e.g., jdoe12), use the UAA CLI (uaac) to update the email field:

uaac user update <USERNAME> --emails <[email protected]>

 

3. Handle External Identity Providers (LDAP/SAML)

If the foundation is federated with an external IDP:

  • Do Not use uaac member add to assign scopes directly to LDAP/SAML users. Tanzu Hub recalculates permissions during token exchange and will strip manual assignments.
  • Mapping: Users must inherit their permissions via an External Group Mapping configured in UAA that maps their backend LDAP/SAML group to the required UAA scopes.

 

4. Confirm Synchronization

After making changes, wait for the synchronization cycle:

  • Role-related events: Typically processed within ~1 minute.
  • Full Sync: Occurs every 20 minutes.
  • Verification: Navigate to Tanzu Hub > Administration > Users & Groups to confirm the user appears with the correct role mapping.

 

Related Information

Powered by Wolken Software