Login to Management Interface (VAMI) of a vCenter or Platform Service Controller fails with the message "Exception in invoking authentication handler User password expired"

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

Logging in to the VAMI page of a vCenter or PSC Appliance (https://<VC FQDN>:5480) fails with the message:

Exception in invoking authentication handler User password expired

The Appliance was deployed more than 90 days ago with default settings.

Login to the Appliance Shell (SSH or VM Console) is working.

From the Shell Session "chage -l root" returns an output similar to:

root@xxxxxx [ ~ ]# chage -l root
You are required to change your password immediately (root enforced)
chage: PAM: Authentication token is no longer valid; new one required

Cause

This issue occurs when the root password of the appliance (PSC or vCenter) server is expired.

In vSphere 6.5 and later the root password expire after 90 days by default; in older versions it was 365 days.

After deploying the Appliance, modify the the Password Settings of the Root User through the vCenter Server Appliance Management Interface as needed.

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/6-5/configuring-vcenter-server-6-5/configuring-vcenter-server-using-the-management-interface/change-the-root-password-and-configure-the-password-expiration-settings.html

Resolution

• Reset the root password of the Appliance using the "passwd" command.

# passwd root

 

You can later modify the Password Settings of the Root User through the vCenter Server Appliance Management Interface.

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/6-7/configuring-vcenter-server-6-7/configuring-vcenter-server-using-the-management-interface/change-the-root-password-and-configure-the-password-expiration-settings.html

You can configure different expiry times including "never expire" and set an email address to which the expiration warning is sent.

• Re-Verify password expiration with this command:

# chage -l root

Last password change                                    : May 13, 2024
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : -1
Number of days of warning before password expires       : 7

Additional Information

Resetting the root password in vCenter Server Appliance