Configuring Identity Provider with Embedded Identity Broker fails with "The LDAP binding has failed" in VCF 9.x

Products

• VMware vCenter Operations Manager

Issue/Introduction

When configuring an Identity Provider (IDP) using the embedded VCF Identity Broker in VMware Cloud Foundation 9.0 / 9.x, the setup fails.

UI Error: The user interface displays the following message:

Saving configuration settings failed with the following error: The LDAP binding has failed.

Log Location & Error Details:

Reviewing the usergroup-service.log (/var/log/vmware/vc-ws1a-broker/usergroup-service.log) reveals entries similar to:

INFO ... ActiveDirectoryServiceImpl - Attempting to connect to Active Directory hosted on (X.X.X.X:389) and perform a bind operation with the following bindDn: (administrator)
ERROR ... ActiveDirectoryServiceImpl - Unable to bind to Active Directory with the following bindDn: (administrator)
WARN ... Request failed with status_code: 400 ... cause: com.vmware.vidm.usergroup.model.exceptions.broker.connector.LdapDirectoryBindingException

Environment

Product: VMware Cloud Foundation (VCF) 9.0 / 9.x
Component: VCF Identity Broker (Embedded)
Directory Type: Active Directory / LDAP / LDAPs

Cause

This issue occurs because the Bind User Name (bindDn) was entered using a non-standard username format (such as administrator or DOMAIN\administrator).
The VCF Identity Broker requires the Bind User Name to be specified in full LDAP Distinguished Name (DN) format (e.g., CN=...,OU=...,DC=...) to properly evaluate and authenticate the bind request against Active Directory.

Resolution

To resolve this issue, update the Identity Provider configuration settings to use the full LDAP Distinguished Name (DN) format for the Bind User.
Standard LDAP DN : CN=Administrator,CN=Users,DC=domain,DC=local

Save the configuration and retry the Identity Provider bind operation.