Logging in to vSphere Web Client fails with the error: Client is not authenticated to VMware Inventory Service
Article ID: 302240
Updated On:
Products
VMware
Issue/Introduction
Symptoms:
- After you upgrade from vSphere 5.0 to vSphere 5.5, a user in an Active Directory domain cannot log in to the vSphere Web Client.
- You see the error:
Client is not authenticated to VMware Inventory Service
Cause
This issue occurs because permissions for group names are case sensitive in vCenter Single Sign-On (SSO) 5.5GA, but not case sensitive in vCenter Server 5.0.
When you assign permissions in vCenter Server 5.0, and you enter group names in a different case than the corresponding Active Directory group name, users in those groups can log in successfully.
When you assign permissions in vCenter Server 5.0, and you enter group names in a different case than the corresponding Active Directory group name, users in those groups can log in successfully.
In vSphere 5.5GA (Build Number 1312298), if there is a case inconsistency between the Active Directory group name and the group name in the permission, users in that group cannot log in to the inventory service with vCenter Single Sign-On.
This issue also occurs if you install vSphere 5.5GA and change a group name to a different case in Active Directory after the permission was assigned using the former group name in vCenter Server.
This issue is resolved in vSphere 5.5.0a. For more information, see the Resolution section of this article
| Release version (including all updates/patches) | Case-sensitive Group name comparisons |
| vSphere 5.0 | No |
| vSphere 5.1 | Yes |
| vSphere 5.5 | Yes |
| vSphere 5.5.0a | No |
Resolution
This issue is resolved in vCenter Server 5.5.0a, available at VMware Downloads. For more information, see the VMware vCenter Server 5.5 Release Notes.
To work around this issue on vSphere 5.5 GA (Build Number 1312298), delete all permissions for the group that was added in a different case than the case currently used in Active Directory, and then add the permissions again.
To work around this issue on vSphere 5.5 GA (Build Number 1312298), delete all permissions for the group that was added in a different case than the case currently used in Active Directory, and then add the permissions again.
- Delete the group's permission. For more information, see Remove Permissions in the vSphere Web Client in the vSphere 5.5 Security Guide.
- Add the permission using the case for the group that is used in Active Directory. For more information, see Assign Permissions in the vSphere Web Client in the vSphere 5.5 Security Guide.
Additional Information
Feedback
Yes
No
Powered by
