vSphere 6.7 HTML5 client cannot query more than 200 principals while adding permissions in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

In vSphere 6.7, the HTML5 client may not retrieve all users and groups in an Active Directory domain. This is observed when attempting to apply a vCenter or Global permission to a user or group. 

The following log message is observed in /var/log/vmware/sso/ssoAdminserver.log:

[INFO ][2018-05-11T16:24:00.564Z][] PrincipalDiscoveryServiceImpl - [User {Name: vsphere-webclient-########-####-####-####-########80c4, Domain: vsphere.local} with role 'Administrator'] Find at most 200 principals by name matching criteria searchString=, domain=example.com

• Note: the domain value will differ in your environment

Using the flash-based vSphere Client allows you to query all users/groups details. Only html unable to update user details.

Note: This issue does not manifest in vCenter Server 6.7.0 c, but is encountered in all other versions of 6.7 .

Environment

VMware vCenter Server 6.7.x

Resolution

This issue is resolved in vCenter Server 6.7 Update U3j available at Broadcom Downloads .

For more information on patching a vCenter Server Appliance node, see Patching the vCenter Server Appliance and Platform Services Controller Appliance

Additional Information

Note: There is one more issue observed while querying the Users from HTML Client -> Administration > Single Sign On > Users and Groups > Select Users > Select AD domain > Search under UserName, it will not list more than 200 Users.