SAML SSO Login Loop Caused by Outdated Federation Metadata in Tanzu Hub

Products

• VMware Tanzu Platform Core

Issue/Introduction

This article outlines the troubleshooting steps to resolve login loops occurring during SAML single sign-on (SSO) authentication in Tanzu Hub. This behavior typically indicates that the Federation Metadata XML file stored in the Tanzu Hub settings is outdated and no longer matches the current configuration in the identity provider.

Symptoms:

• Users input the system alias during login.
• The system initiates the Azure/Entra ID authentication flow.
• The page reloads or returns to the login screen instead of granting access to the platform.
  
  
  

 

Environment

• Tanzu Hub
• Azure Active Directory 

Cause

The Federation Metadata XML file currently configured within the Tanzu Hub settings does not match the metadata exported from the active Azure tenant.

Resolution

Update the Tanzu Hub configuration with the current Federation Metadata from the identity provider.

1. Retrieve the Federation Metatdata XML from Azure.
2. Navigate to the Tanzu Hub administration settings page.
3. Upload the updated Federation Metadata XML file retrieved from the Azure Portal.
4. Save the configuration settings.
5. Test the authentication flow to confirm users access the platform without redirection loops.

Additional Information

If the issue persists after updating the metadata, gather browser network traces (HAR files) and review where the issue is happening and address accordingly.