After NSX 9.1.0.0 upgrade, user log-in using vIDM is not working
search cancel

After NSX 9.1.0.0 upgrade, user log-in using vIDM is not working

book

Article ID: 455402

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • After upgrading to NSX 9.1.0.0, login via vIDM results in an infinite browser redirect loop.
  • Inspection of HAR files will show hundreds of requests to/login.jsp or /vidm-oauth2-login per minute.

    POST /vidm-oauth2-login (empty body) → 302 Location: /login.jsp → GET /login.jsp (200) → repeat, 90+ times within
      under a minute.
  • The browser never establishes a session and never reaches vIDM's external /SAAS/auth/oauth2/authorize endpoint.

  • localhost_access_log on NSX Manager shows hundreds of POST /vidm-oauth2-login requests are created in a single minute. 

     grep 2026-01-01T20:18 localhost_access_log* | grep -i oauth2 | wc -l

    432

    (432 above is a sample number. This number would be very high)

    localhost_access_log.txt.10:2026-01-01T20:18:51.268Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 668 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:51.393Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 687 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:51.524Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 730 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:51.644Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 750 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:51.780Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 595 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:51.903Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 840 0 ######################
    .
    .
    .
    localhost_access_log.txt.10:2026-01-01T20:18:52.037Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 665 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:52.158Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 768 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:52.292Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 587 0 ######################
    localhost_access_log.txt.10:2026-01-01T20:18:52.432Z 127.0.0.1 - "POST /vidm-oauth2-login HTTP/1.1" 200 - 975 0 ######################

Environment

NSX 9.1.0.0

Cause

This is a known issue impacting VMware NSX 9.1.0.0 where the legacy login renderer incorrectly redirects to a deleted OAuth route, failing to establish a session cookie.
The NSX Manager is rendering legacy-login-page-renderer.jsp (used when a cluster component's transformer version is below 9.0 — "pinned mode," consistent with an in-progress/partial upgrade). The code unconditionally auto-redirects to vidm-oauth2-login on every page load whenever VIDM is enabled and healthy. VIDM login was rewritten on Spring Security's (Spring Security handles Layer 7 user authentication) native OAuth2 client, which now lives at /oauth2/authorization/ws_one_VIDM. Because the route doesn't exist, Spring Security's unauthenticated-request handler bounces the request back to /login.jsp, which reloads and immediately fires the same dead redirect again — an infinite loop that starts on page load, requires no user interaction, and never reaches code that would issue a session cookie.

Resolution

The fix will be included in upcoming NSX versions.

If you need a workaround on your current and impacted version, please open a support request with Global Support (GS) and reference this Knowledge Base article.

Powered by Wolken Software