This issue occurs because Single Sign-On tokens contain the complete list of groups of the user at the time the token is issued. The vCenter Security subsystem specifically allows assigning permissions on multiple levels in the vCenter hierarchy, whereby a group of users might have less permissions on an inventory object as compared to the permissions on the parent inventory object. When such permissions are assigned to a group when there is a malfunctioning identity source, not having the list of groups from this domain might allow for unauthorized access. Logon is therefore prevented if any identity source is down.
To work around this issue:
Note:You need to manually add the domain when it is available again.
By performing this action, users and groups from the removed identity source may be removed. To ensure that permissions for users and groups from the removed identity source are not removed by the daily permission validation check: