"Cannot load the users for the selected domain / Error while extracting local SSO users", Unable to add Active Directory users or groups to vCenter Server Appliance or vRealize Automation permissions
book
Article ID: 322244
calendar_today
Updated On:
Products
VMware Aria SuiteVMware vCenter Server
Issue/Introduction
When using the Active Directory (Integrated Windows Authentication) identity source from the vCenter Single Sign-On 5.5 (SSO), Platform Services Controller 6.0 (PSC), or vRealize Automation Identity Appliance, you experience these symptoms:
Attempting to browse and add users to the vCenter Server permissions (Local Permission: Hosts and Clusters > vCenter > Manage > Permissions, Global Permissions: Administration > Global Permissions) fails with one of below errors:
Cannot load the users for the selected domain. OR Error while extracting local SSO users
Attempting to browse users from your Active Directory Domain under the Users tab (Administration > Users and Groups) in the vCenter Server fails with the error:
com.vmware.identity.idm.IDMException: Failed to establish server connection.
Attempting to browse and add users to the vRealize Automation Center permissions fails with the error:
System Exception.
In the /var/log/vmware/sso/vmware-sts-idmd.log file on the vCenter Single Sign-On or Platform Services Controller, you see entries similar to:
[YYYY-MM-DDT<time>Z vsphere.local 3572c5f8-####-####-####-d94f68634a2f WARN ] [ServerUtils] cannot bind connection: [ldap://<Active Directory Domain Controller FQDN>, null]</time> [YYYY-MM-DDT<time>Z vsphere.local 3572c5f8-####-####-####-d94f68634a2f ERROR] [ServerUtils] cannot establish connection with uri: [ldap://<Active Directory Domain Controller FQDN>]</time> [YYYY-MM-DDT<time>Z vsphere.local 3572c5f8-####-####-####-d94f68634a2f INFO ] [ActiveDirectoryProvider] removeDcInfo - domain [<Active Directory Domain Name>], domainFQDN [<Active Directory Domain Controller FQDN>], domainIpAddress [<Active Directory Domain Controller IP]</font></time> [YYYY-MM-DDT<time>Z vsphere.local 3572c5f8-####-####-####-d94f68634a2f ERROR] [ActiveDirectoryProvider] Failed to get non-GC connection to domain <Active Directory Domain> - domain controller might be offline</time> com.vmware.identity.interop.idm.IdmNativeException: Native platform error [code: 40287][LW_ERROR_LDAP_LOCAL_ERROR][] at com.vmware.identity.interop.idm.LinuxIdmNativeAdapter.LdapSaslBind(LinuxIdmNativeAdapter.java:345) at com.vmware.identity.interop.ldap.LinuxLdapClientLibrary.ldap_sasl_bind_s(LinuxLdapClientLibrary.java:676) at com.vmware.identity.interop.ldap.LdapConnection.bindSaslConnection(LdapConnection.java:158) at com.vmware.identity.idm.server.ServerUtils.getLdapConnection(ServerUtils.java:297) at com.vmware.identity.idm.server.ServerUtils.getLdapConnectionByURIs(ServerUtils.java:215)
...
[YYYY-MM-DDT<time>Z</time> vsphere.local b77dc08e-####-####-####-eee92feae7c6 WARN ] [ServerUtils] cannot bind connection: [ldap://<Active Directory Domain Controller FQDN>, null] [YYYY-MM-DDT<time>Z</time> vsphere.local b77dc08e-####-####-####-eee92feae7c6 ERROR] [ServerUtils] cannot establish connection with uri: [ldap://<Active Directory Domain Controller FQDN>] [YYYY-MM-DDT<time>Z</time> vsphere.local b77dc08e-####-####-####-eee92feae7c6 ERROR] [ActiveDirectoryProvider] Failed to get non-GC connection to domain <Active Directory Domain Name> in retry com.vmware.identity.interop.idm.IdmNativeException: Native platform error [code: 40287][LW_ERROR_LDAP_LOCAL_ERROR][] YYYY-MM-DDT<time>Z</time> vsphere.local b77dc08e-####-####-####-eee92feae7c6 ERROR] [IdentityManager] Failed to find person users [Criteria : searchString=, domain=markit.partners] in tenant [vsphere.local] [YYYY-MM-DDT<time>Z</time> vsphere.local b77dc08e-####-####-####-eee92feae7c6 ERROR] [ServerUtils] Exception 'com.vmware.identity.idm.IDMException: Failed to establish server connection' com.vmware.identity.idm.IDMException: Failed to establish server connection ... Caused by: com.vmware.identity.idm.IDMException: Failed to get non-GC connection to domain <Active Directory Domain Name> in retry [YYYY-MM-DD <time> vsphere.local 9439b581-####-####-####-39d3af448747 WARN ] [ServerUtils] cannot bind connection: [ldap://</time><Active Directory Domain Controller FQDN>, null] [YYYY-MM-DD <time> vsphere.local 9439b581-####-####-####-39d3af448747 ERROR] [ServerUtils] cannot establish connection with uri: [ldap://</time><Active Directory Domain Controller FQDN>] [YYYY-MM-DD <time> vsphere.local 9439b581-####-####-####-39d3af448747 ERROR] [IdentityManager] Failed to find person users [Criteria : searchString=po.tenant, domain=<Active Directory Domain Name>] in tenant [vsphere.local] </time> [YYYY-MM-DD <time> vsphere.local 9439b581-####-####-####-39d3af448747 ERROR] [ServerUtils] Exception 'com.vmware.identity.idm.IDMException: Failed to establish server connection' </time> com.vmware.identity.idm.IDMException: Failed to establish server connection ... 22 more
Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.
Environment
VMware vCenter Server Appliance 6.0.x VMware vCenter Server Appliance 5.5.x VMware vCenter Server Appliance 6.5.x VMware vCloud Automation Center for Desktop 6.1.x VMware vRealize Automation 6.2.x VMware vCenter Server Appliance 6.7.x VMware vCenter Server 7.0.x VMware vCloud Automation Center for Desktop 6.0.x
Cause
This issue occurs because the Likewise Kerberos stack requires all DNS servers to be configured with the Reverse Lookup Zone and that all Active Directory Domain Controller (AD DC) Pointer (PTR) records are available. The Likewise Kerberos stack in the Appliances use both Forward and Reverse Name Lookup to canonically organize hostnames for use in service principal names.
Resolution
To resolve this issue, ensure that all DNS servers have the Reverse Lookup Zone configured and Active Directory Domain Controller (AD DC) Pointer (PTR) records present.
Checking Active Directory Domain Controller DNS Resolution:
Initiate an SSH connection to the Appliance.
Enter the root username and password when prompted.
Note: If you are using vSphere 6.0, run this command to switch to the Bash shell:
shell.set --enable True shell
Using nslookup from the Appliance, run this command to ensure there is DNS resolution for Forward Lookup for the Domain Controllers determined from the Checking Trust Enumeration section:
nslookup dc2-root.DomainA.local
Note: This command displays the IP address of the Domain Controller.
Non-authoritative answer: 81.10.10.10.in-addr.arpa name = <Incorrect FQDN>.
Authoritative answers can be found from:
Repeat Steps 1 to 4 for any additional Active Directory Domain Controllers to determine the records that are missing or incorrect.
To resolve the issue when there are missing or incorrect records, use one of these options:
Option 1: Create or update the PTR record(s) for the Active Directory Domain Controller(s) on the listed DNS Servers from the Determining the Appliance's DNS Servers section.
Option 2: Update the DNS servers configured on the appliance to use DNS servers containing the correct PTR for your Active Directory Domain Controllers records. For more information, see Edit the DNS and IP Address Settings of the vCenter Server Appliance section in the vCenter Server Appliance Configuration guide.