Unable to login through VIDB VCF SSO Identity Source

Products

VCF Operations

Issue/Introduction

When logging into the VCF Operations web UI using the VCF SSO Login Method, the webpage redirects to Directory Login but users fail to login with the following error:

"Authentication was unsuccessful. Verify your credentials or contact your administrator if the issue persists."

There are no issues noted in the VCF Operations web UI under Manage - Fleet Management - Identity & Access - VCF SSO Overview
The VCF SSO Identity Broker is configured correctly with VIDB to match your Identity Source's Active Directory configuration and users
The above webpage URL is redirected to VIDB, similar to: http(s)://FQDN/vidb/login
There are no errors in the VCF Operations analytics or analytics.audit logs regarding logins using VCF SSO Login Method to the VIDB
Under Build - Lifecycle - VCF Management - Components, Identity Broker and VCF services runtime are Running
All vcf-management-services VMs are powered on and healthy

Environment

vSphere Cloud Foundation 9.1

Cause

There is a misconfiguration in the VCF SSO configuration for the associated Identity Broker.

These errors are not propagated to VCF Operations logs because they are logged in the VIDB kubernetes pod.

The VIDB kubernetes pod resides in the vcf-management-services cluster.

Resolution

The VIDB kubernetes pod's logs will need to be checked to confirm that they are running, healthy and for related logs to login failures using VCF SSO.

Obtain the credentials for vmware-system-user for VCF Component: VCF services runtime
Navigate to VCF Operations - Operate - Inventory and drill down to VM folder: vcf-management-services
Locate the IP address for the control plane node of the vcf-management-service cluster
- The control plane node will have less Memory and vCPUs assigned to it than the worker nodes in the cluster.
- There is typically only one control plane node in this four node cluster. The control plane node has two IPv4s assigned.
SSH to the control plane node's IP address as vmware-system-user
- Only the control plane node will have the functionality to run kubectl commands
Switch to root:
```
sudo -i
```
- The following commands are Read-Only and will not affect the environment.
- Exercise caution as root user in any environment.
Run the following kubectl command to list all pods in the VIDB namespace:
```
kubectl get pods -n vidb-external
```
These pods must be troubleshooted and restored to Running state in order for the VIDB service to function properly for VCF SSO login.
If these pods are already in Running state, proceed to the next steps.
In a web browser, reproduce the VCF SSO Login Authentication Failure for recent logging
View the VIDB service pod logs with the below kubectl command:
```
kubectl logs -n vidb-external <vidb-service pod name>
```
See Additional Information for known errors.
Correct the VCF SSO's Identity Broker configuration based on the errors found in the above pod logs.
Perform a Sync on the Identity Source to ensure the integrated directory is up to date:
1. In the VCF Operations web UI, navigate to Manage - Fleet Management - Identity & Access - VCF SSO Overview - Identity Broker Name - Identity Source tab
2. Click on the refresh icon under Sync on Request next to the associated directory to perform a manual sync

Additional Information

Unable to find a user with the given user identifier.

Found (0) user(s) having the (<AD user@domain>) attribute under base distinguished name (<Base DN configuration in VCF SSO Identity Broker>) - FAILURE.

Validate the noted AD user's Canonical name and if this user matches the above noted Base DN
Confirm that this user is propagated to the Identity Source in VCF Operation's Identity & Access
Check that the Base DN for the Identity Source is configured properly in VCF Operation's Identity & Access