Supervisor Authentication Group Claims Missing via VCF SSO in VCF-A 9.1

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Users experience an issue with authentication to the Supervisor when utilizing the VCF SSO in VCF Automation . The Supervisor is integrated into VCFA and uses Pinniped to authenticate users by redirecting them to VCFA's VCF SSO. After an upgrade of vIDB to 9.1, roles are now deferred to the identity provider in the VCF SSO.

When a user logs in, they correctly inherit the VCFA Role (assigned by "Defer to Identity Provider"), but the user is no longer associated with a group in VCFA. Consequently, when configuring RBAC on the Supervisor, the user is authenticated but does not receive any group claims because VCF-A no longer shows groups for users authenticated via VCF SSO.

Environment

VCF Automation 9.1 

VIDB 9.1 

Cause

In VCF 9.1, SSO behavior changed so that roles and access are defined in VCF Operations and pushed to each component. VCF SSO does not natively support the Supervisor, meaning it must be configured separately. When a Supervisor is added to VCFA, VCFA acts as the Identity Provider (IDP); therefore, the group role must be configured in VCF Operations and subsequently added to VCFA with "Defer To Identity Provider" to allow for RBAC at the Supervisor level.

Resolution

 

• Configure the required group role within VCF Operations (VCF Ops).

• Add the corresponding group to VCFA.

• Assign the role "Defer to Identity Provider" to the group within VCFA.

• Verify that the group is now visible against the relevant user when they log into VCFA.

• Authenticate via the Supervisor to confirm the group claims are successfully passed and RBAC is functioning as expected.