Troubleshooting failed log in attempts to the vSphere Web Client in vSphere 5.1

Products

• VMware vCenter Server

Issue/Introduction

This article guides you through the troubleshooting process when an attempt to log into the vSphere Web Client fails in vSphere 5.1. It helps you eliminate the common causes for your problem by verifying the scope of the issue, as well as providing information on correcting common configuration issues that prevent logging into the vSphere Web Client.

Symptoms:

• You cannot log into the vSphere Web Client in vSphere 5.1
• Logging into the vSphere Web Client fails
• You see one or more of these errors:
  
  
  • Provided credentials are not valid
  • User account is locked
  • Failed to communicate with the vCenter Single Sign On server server-address. The server might have failed to respond or responded in an unexpected way
    
    
• You cannot log into an ESXi host using the vSphere Web Client

Environment

VMware vCenter Server Appliance 5.1.x
VMware vCenter Server 5.1.x

Resolution

Validate that each troubleshooting step below is true for your environment. Each step provides instructions or a link to a document to eliminate possible causes and take corrective action as necessary. The steps are ordered in the most appropriate sequence to isolate the issue and identify the proper resolution. Do not skip a step when troubleshooting in each subsection of the document.

1. If you see the Provided credentials are not valid error while logging into the vSphere Web Client, perform these steps:
   
   
   1. Ensure that you are logging in with the correct user name and password.
   2. Try logging in with another account or with the vCenter SSO administrator account. If permissions are not granted to a specific user account, you cannot log in using that account.
   3. Try qualifying the username that you are using. vCenter SSO uses a default domain to avoid conflicts between identity sources. For example, the local administrator and the domain administrator in a Windows environment are often the same login of administrator. If you are not logging in with the correct account context, the authentication may fail because the password is truly not the correct password. For more information on user qualifications, see Understanding and troubleshooting vCenter Single Sign-On users, groups, and login qualifications (2033875).
   4. Verify if the password has expired. If you are using System-Domain authentication with SSO, another SSO administrator must reset the password. If you are using an Active Directory or Open LDAP source, the account must be reset by the administrator of the directory source.
      
      
2. The User account is locked error indicates that the account has exceeded the maximum number of authentication attempts.
   
   To troubleshoot this issue:
   
   
   1. Try qualifying the username that you are using. vCenter SSO uses a default domain to avoid conflicts between identity sources. For example, the local administrator and the domain administrator in a Windows environment are often times the same login of administrator. If you are logging in with the correct account context, the account may be locked.
      
      For more information on user qualifications, see Understanding and troubleshooting vCenter Single Sign-On users, groups, and login qualifications (2033875).
      
      
   2. Wait until the account is unlocked. Many directory service policies automatically unlock accounts after a period of time. Contact your administrator to determine the amount of time that an account will stay locked. With vCenter SSO, this timeout is 15 minutes.
      
      For more information on changing the default SSO policies, see Configuring and troubleshooting vCenter Single Sign On password and lockout policies for accounts (2033823).
      
      
   3. Get the account unlocked by either the SSO administrator or the Active Directory/Open LDAP administrator. The default policy for SSO System-Domain users is set to 3, and for other sources it is the same as that of the directory service.
      
      For more information on changing the default SSO policies, see Configuring and troubleshooting vCenter Single Sign On password and lockout policies for accounts (2033823).
      
      
   4. If there is no other SSO administrator or you cannot wait for the account to get unlocked, the administrator password can be reset manually from the command line.
      
      For more information on resetting the password manually from the command line, see Unlocking and resetting the vCenter Single Sign On (SSO) administrator password (2034608).
      
      
3. The Failed to communicate with the vCenter Single Sign-on server server address error indicates that connectivity to vCenter SSO is lost.
   
   To troubleshoot this issue:
   
   
   1. Validate the network connection to the vCenter SSO server. If there is intermittent or missing connectivity, login attempts fail. To validate connectivity, try pinging the vCenter SSO server from the vSphere Web Client.
      
      For more information, see Testing network connectivity with the ping command (1003486).
      
      
   2. Check if the vCenter SSO server or service is down. To do this, review either the vCenter Single Sign On service on Windows or vmware-sso on the vCenter Server Appliance. Try restarting the service. If there are problems starting the service, see Troubleshooting vCenter Single Sign On when it does not start (2034517).
      
   <LITHE vsphere="" web="" client="" included="" with="" 5.1="" does="" not="" support="" logging="" directly="" into="" an="" esxi="" host.="" if="" direct="" host="" access="" is="" required,="" use="" the="" client.<="" li=""></LITHE>

Note: If the issue persists after trying the steps in this article:

• Gather the VMware Support Script Data. For more information, see Collecting diagnostic information for VMware products (1008524).
  
• File a support request with VMware Support and note this Knowledge Base article ID (2034506) in the problem description. For more information, see How to Submit a Support Request.

Additional Information

Testing network connectivity with the ping command
Collecting diagnostic information for VMware products
Configuring and troubleshooting vCenter Single Sign On password and lockout policies for accounts
Understanding and troubleshooting vCenter Single Sign-On users, groups, and login qualifications
Troubleshooting vCenter Single Sign On when it does not start
Resetting the vCenter SSO administrator password
vSphere 5.1 のvSphere Web Client へのログイン失敗のトラブルシューティング
vSphere 5.1 中的 vSphere Web Client 登录尝试失败故障排除