Local users created in VMware vCenter Single Sign-On 6.0 fail to log in after modifying the maximum lifetime value for password expiration

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

After you modify the maximum lifetime password expiration value for VMware vCenter Single Sign-On 6.0, you experience these symptoms:

• Local users created in VMware vCenter Single Sign-On are unable to log in
• You see the error:
  
  Incorrect username/password
   
• The C:\PogramData/VMware/vCenterServer/logs/sso/vmware-sts-idmd.log file on the Platform Services Controller has entries similar to:
  
  [2015-06-24T11:36:04.877-05:00 SSO_Domain ########-####-####-####-########b50f ERROR] [IdentityManager] Failed to authenticate principal [username@SSO_Domain]. User password expired.
  [2015-06-24T11:36:04.877-05:00 SSO_Domain ########-####-####-####-########b50f INFO ] [IdentityManager] Authentication failed for user [username@SSO_Domain] in tenant [SSO_Domain] in [13] milliseconds with provider [SSO_Domain] of type
  com.vmware.identity.idm.server.provider.vmwdirectory.VMwareDirectoryProvider]
  [2015-06-24T11:36:04.877-05:00 vsphere.local ########-####-####-####-########b50f ERROR] [ServerUtils] Exception 'com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: username, Domain: SSO_Domain}'
  com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: username, Domain: SSO_Domain}
  at com.vmware.identity.idm.server.provider.vmwdirectory.VMwareDirectoryProvider.checkUserAccountFlags(VMwareDirectoryProvider.java:1339)
  at com.vmware.identity.idm.server.IdentityManager.authenticate(IdentityManager.java:2518)
  
  Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.
   
• You are able to log in with [email protected]
  
  Note: If you are using a custom VMware vCenter Single Sign-On domain, replace vsphere.local with the name of your VMware vCenter Single Sign-On domain.

Environment

VMware vCenter Server 6.0.x

Cause

This issue occurs when the SSO password expiration lifetime has a larger value than the maximum value permitted.

Resolution

This is a known issue affecting VMware vCenter Server 6.0.

 

Currently, there is no resolution.

 

To work around this issue:
 

1. Log in to the VMware vSphere Web Client as [email protected]
   
   Note: If you are using a custom VMware vCenter Single Sign-On domain, replace vsphere.local with the name of your VMware vCenter Single Sign-On domain.
    
2. Navigate to Configuration > Policies > Password Policy > Edit.
3. Set the password expiration value to a value less than 999999 days.
4. Recreate the users impacted within the VMware vCenter Single Sign-On domain. For more information, see the Add vCenter Single Sign-On Users section in the vSphere Security guide.