Logins to vCenter using SSO fail with 'HTTP Status 400 – Bad Request' error

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• SSO logins to components other than vCenter may function properly.
• Local user logins to vCenter function properly.
• Unable to manually join the vCenter to the AD domain.
• Removing and reconfiguring SSO does not fix the issue.

Environment

• VMware Cloud Foundation 9.1.0

Cause

• The SSO domain has the same name as the AD domain. This is an unsupported configuration.
• This causes SAML creation errors as can be seen in the /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log: 

<date_stamp> INFO vsphere-ui 16986 [vc@4413 threadName="http-nio-127.0.0.1-5090-exec-355" logger="c.v.vsphere.client.security.oauth2.Oauth2CodeResponseHandler" 70166661 103559 ###### ] Received an Oauth2 Authorization co
de. Processing it now for Auth Token and exchange...
<date_stamp> ERROR vsphere-ui 16986 [vc@4413 threadName="http-nio-127.0.0.1-5090-exec-355" logger="c.v.vsphere.client.security.oauth2.Oauth2CodeResponseHandler" 70166661 103559 ###### ] Oauth2 Authorization code assertio
n failed com.vmware.vcenter.tokenservice.InvalidRequest: InvalidRequest (com.vmware.vcenter.tokenservice.invalid_request) => {
messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
id = com.vmware.vcenter.tokenservice.exceptions.InvalidRequest,
defaultMessage = Failed to built SAML2 token for

{Name: vsphere-ui-0044db5f-f270-4f93-b4a1-###########, Domain: <DOMAIN_NAME>}
on behalf of

{Name: <user_name>, Domain: <DOMAIN_NAME>}
,
}, LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
id = com.vmware.identity.idm.InvalidPrincipalException,
defaultMessage = object not found – baseDN: [DC=####,DC=############,DC=com], scope: [SCOPE_SUBTREE], filter: [(&(|(userPrincipalName=<user_name>@<DOMAIN_NAME>)(sAMAccountName=<user_name>))(objectClass=us
er))],

Resolution

1. In a VMware Cloud Foundation 9.1 environment it is not supported to repoint the vCenters to a new SSO domain. 
2. A redeployment of the full stack is required.

Additional Information

See also KB 450887