Error: "Access Denied. Unable to authenticate the user" after push notification is sent back following Okta SSO integration

Products

• VCF Operations
• VMware Cloud Foundation

Issue/Introduction

• /var/log/vmware/vIDB/access-control.log error:

Failed to log in with VCF SSO service. The user did not import or does not belong to any imported group

• $ALIVE_BASE/user/log/analytics.audit-#########.log error:

Invalid login - message: Cannot complete login due to an incorrect user name or password."

 

Environment

VCF Ops: 9.0.2, 9.1

VCF: 9.0, 9.1

Okta SSO

Cause

• User and/or user groups need to be imported into VCF Operations after configuring VCF SSO

• Okta group claims must be tied to the id_token and the Open ID group attribute must be defined as VCF_ADGroupclaim.

Resolution

• Ensure user/groups have been properly added to VCF Ops by applying KB Unable to Log in to VCF Operations UI Using VCF SSO with Error: “Failed to login with VCF SSO service. The user did not import or does not belong to any imported group.”

• Review Okta Docs: Test your authorization server configuration to properly configure Okta:

  1. Log in to the Okta Admin Console.

  2. Navigate to Security > API > Authorization Servers

  3. Ensure group claims are explicitly configured to be included in the ID Token (id_token).

  4. Set the OpenID Group Attribute name to: VCF_ADGroupClaim

  5. Test the configuration using the Okta Token Preview tool to verify that VCF_ADGroupClaim is returned in the ID token payload.