Error: Failed to authenticate user when logging in to domain account - vCenter Server Appliance.
search cancel

Error: Failed to authenticate user when logging in to domain account - vCenter Server Appliance.

book

Article ID: 313931

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

Below error message can be seen while trying to login domain credentials :

When authenticating to the vCenter Server Appliance using domain credentials, login attempts fail. The vSphere Client interface displays an explicit "Failed to authenticate user" message.
The following entries are captured within the appliance logs:

File: /var/log/vmware/sso/websso.log

YYYY-MM-DDT HH:MM:SS INFO websso[<Thread-ID>] [CorId=<Correlation-ID>] [auditlogger] {"user":"<username>","client":"<Client-IP>","description":"User <username> failed to log in with response code 401","type":"com.vmware.sso.LoginFailure"}
YYYY-MM-DDT HH:MM:SS ERROR websso[<Thread-ID>] [CorId=<Correlation-ID>] [com.vmware.identity.samlservice.AuthnRequestState] Caught Exception from authenticate com.vmware.identity.samlservice.SamlServiceException
YYYY-MM-DDT HH:MM:SS INFO websso[75:tomcat-http--37] [CorId=3cff7daf-c3ec-4a3d-9da3-2b507af4da64] [com.vmware.identity.samlservice.impl.SAMLAuthnResponseSender] Responded with ERROR 401 message Invalid credentials

File: /var/log/vmware/sso/vmware-identity-sts-default.log

YYYY-MM-DDT HH:MM:SS ERROR sts-default[<Thread-ID>] [CorId=<Correlation-ID>] [com.vmware.identity.idm.server.IdentityManager] Failed to get attributes for principal [<machine-account>@vsphere.local] in tenant [vsphere.local]
YYYY-MM-DDT HH:MM:SS ERROR sts-default[<Thread-ID>] [CorId=<Correlation-ID>] [com.vmware.identity.idm.server.ServerUtils] Exception 'java.lang.NullPointerException' java.lang.NullPointerException: null at com.vmware.identity.idm.server.IdentityManager.getForeignTrustProviderIfExternalIdp(IdentityManager.java:13076)

File: /var/log/vmware/vpxd/vpxd.log

YYYY-MM-DDT HH:MM:SS info vpxd[<Thread-ID>] [Originator@6876 sub=vpxLro opID=<Op-ID>] [VpxLRO] -- BEGIN task-internal-1547326 -- SessionManager -- vim.SessionManager.login -- <Session-ID>
YYYY-MM-DDT HH:MM:SS error vpxd[<Thread-ID>] [Originator@6876 sub=[SSO] opID=<Op-ID>] [UserDirectorySso] AcquireToken exception: N9SsoClient27InvalidCredentialsExceptionE(Authentication failed: Invalid credentials)
YYYY-MM-DDT HH:MM:SS error vpxd[<Thread-ID>] [Originator@6876 sub=User opID=<Op-ID>] Failed to authenticate user <DOMAIN>\<username>
YYYY-MM-DDT HH:MM:SS info vpxd[<Thread-ID>] [Originator@6876 sub=vpxLro opID=<Op-ID>] [VpxLRO] -- FINISH task-internal-1547326
YYYY-MM-DDT HH:MM:SS info vpxd[<Thread-ID>] [Originator@6876 sub=Default opID=<Op-ID>] [VpxLRO] -- ERROR task-internal-1547326 -- SessionManager -- vim.SessionManager.login: vim.fault.InvalidLogin

--> Result:
--> (vim.fault.InvalidLogin) {
--> faultCause = (vmodl.MethodFault) null,
--> msg = ""
--> }
--> Args:
-->
--> Arg userName:
--> "<DOMAIN>\<username>"
--> Arg password:
--> (not shown)
-->
--> Arg locale:

File: /var/log/vmware/sso/vmware-sts-idmd.log

YYYY-MM-DDT HH:MM:SS Native platform error [code: 40087][LW_ERROR_CLOCK_SKEW][Clock skew detected with active directory server]

and/or:

[YYYY-MM-DDT HH:MM:SS vsphere.local <Correlation-ID> ERROR] [IdentityManager] Failed to authenticate principal [<username>@<DOMAIN>] for tenant [vsphere.local]
com.vmware.identity.interop.idm.IdmNativeException: Native platform error [code: -1765328347][null][null]
Note: The preceding log excerpts are examples. Environmental variables, thread handles, and specific correlation identifiers will reflect individual deployment states.

 

Environment

VMware vCenter Server 7.x
VMware vCenter Server 8.x

Cause

This issue occurs due to one of the following environmental disruptions:

  • Clock Skew: A time discrepancy exists between the vCenter Server Appliance system clock and the Active Directory Domain Controller (or trusted domains) that exceeds the maximum allowable protocol threshold.
  • Network Impediments: Network connectivity issues prevent communication with the domain infrastructure, such as an offline Domain Controller or firewalls blocking UDP Port 123 (NTP).
  • Resource Contraints: High CPU or memory utilization levels on the vCenter Server Appliance lead to degraded response times within the internal Identity Manager service layers.

Resolution

To resolve this behavior, ensure consistent time synchronization across the entire infrastructure using these steps:

  1. Connect to the vCenter Server Appliance via SSH using root accounts.
  2. Execute the following command to check the current appliance system time configuration: date
  3. Cross-reference the output time against the system clock of the destination Active Directory Domain Controllers.
  4. If a time difference is detected, log in to the vCenter Server Appliance Management Interface (VAMI) at https://<vCenter-IP-or-FQDN>:5480.
  5. Navigate to Time and verify that time synchronization is configured correctly. Ensure identical, authoritative NTP servers are utilized by the appliance and the domain topology.
  6. Ensure that network firewalls explicitly permit bidirectional traffic over UDP Port 123 between the vCenter Server Appliance, domain controllers, and designated external network time services.
  7. Verify appliance performance by checking resource usage with the following tool to rule out timing delays driven by high resource usage: top
Powered by Wolken Software