This article will help to resolve AD Domain login failure issues by performing Active Directory Domain Operations such as Join/Leave/Query on vCenter Server Appliance 6.x or 7.x using CLI,
Following are the operations that can be performed using the CLI:
- Join VCSA/PSC to AD Domain
- Leave VCSA/PSC from AD Domain
- Query Domain Join Status on VCSA/PSC
This article can also be utilized to perform AD Domain Join operation for the new vCenter Server Appliance.
Symptoms:
- Domain Account (AD login) fails with "Invalid Credentials" error message in vSphere Client
- SSO logs on vCenter Server or PSC shows errors similar to the one mentioned below :
Log files:
/var/log/vmware/sso/vmware-sts-idmd.log
OR
/var/log/vmware/sso/vmware-identity-sts-default.log
Note: The list of errors are not only the ones listed below and there could be more related error messages for the same issue
[<DATEandTIME> vsphere.local########-####-####-####-########9c78 INFO ] [VmEventAppender] EventLog: source=[VMware Identity Server], tenant=[vsphere.local], eventid=[USER_NAME_PWD_AUTH_FAILED], level=[ERROR], category=[VMEVENT_CATEGORY_IDM], text=[SimpleMessage[message=Failed to authenticate principal [account@domain_name]. Native platformerror [code: 851968][null][null]]], detailText=[Native platform error [code: 851968][null][null]], corelationId=[########-####-####-####-########9c78], timestamp=[1504459985968]
[<DATEandTIME> vsphere.local ########-####-####-####-########9c78 ERROR] [IdentityManager] Failed to authenticate principal [account@domain_name]. Native platform error [code: 851968][null][null]
com.vmware.identity.interop.idm.IdmNativeException: Native platform error [code: 851968][null][null]
at com.vmware.identity.interop.idm.LinuxIdmNativeAdapter.AuthenticateByPassword(LinuxIdmNativeAdapter.java:188) ~[vmware-identity-platform.jar:?]
at com.vmware.identity.idm.server.provider.activedirectory.ActiveDirectoryProvider.authenticate(ActiveDirectoryProvider.java:282) ~[vmware-identity-idm-server.jar:?]
at com.vmware.identity.idm.server.IdentityManager.authenticate(IdentityManager.java:2980) ~[vmware-identity-idm-server.jar:?]
at com.vmware.identity.idm.server.IdentityManager.authenticate(IdentityManager.java:9761) ~[vmware-identity-idm-server.jar:?]
[<DATEandTIME> vsphere.local ########-####-####-####-########9c78 INFO ] [IdentityManager] Authentication failed for user [account@domain_name] in tenant [vsphere.local] in [71] milliseconds with provider [domain_name] of type [com.vmware.identity.idm.server.provider.activedirectory.ActiveDirectoryProvider]
<DATEandTIME> vsphere.local ########-####-####-####-########8e14 ERROR] [ServerUtils] Exception ‘com.vmware.identity.idm.IDMLoginException: Native platform error [code: -1765328360][null][null]’ com.vmware.identity.idm.IDMLoginException: Native platform error [code: -1765328360][null][null]
- Similar login failure can happen on vCenter Server in VMware Cloud Foundation environment as well
Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.