book
Article ID: 336124
calendar_today
Updated On:
Environment
VMware vCenter Server 5.1.x
Cause
VMware vSphere 5.1 introduces a new authentication method, Single Sign-On, and during the install it may have removed permissions for local identity sources. This results in users being unable to log in.
The Single Sign-On installation may fail to detect the domain for the vCenter Server users and prevent it from adding the Active directory (AD) domain as a valid identity source to allow those users to log in.
This commonly occurs if Single Sign-On is installed as a multisite/HA installation. Local OS sources are not used for authentication. This prevents any users you have set up on the local OS access into vCenter Server from logging in.
Typically, the local OS group Administrators is removed. This means they can no longer log in due to this being a multisite installation, even if they are kept in the database.
Resolution
To work around this issue when you cannot upgrade, specify port 3268 as the Primary Server URL.
To specify port 3268 as the Primary Server URL:
- If you have not already done so, install the Web Client.
- Log into the Web Client as admin@system-domain.
- Navigate to Administration > Sign-On and Discovery > Configuration.
Note: The screen is split into two sections with Identity Sources above and Default domains below.
- Under Identity Sources, verify that your domain is listed as a valid identity source.
- If your domain is not listed, add the domain:
Click the + (green) symbol and enter the required information. For example:
- Name: Any name you want to refer to this Identity source as (typically the domain name)
- Primary Server URL: ldap://domain_server_FQDN:3268
- Secondary Server URL: optional
- Base DN for users: DC=domain,DC=int
- Domain Name: Domain_Name_or_FQDN
- Base DN for groups: DC=domain,DC=int
- Authentication Type: (How you want to authenticate the initial connection to your domain)
Caution: Specify the port 3268 for the Primary Server URL, which otherwise defaults to port 389. Allowing it to default to port 389 may impact log in via SSO.
- Test the connection to verify connectivity.
- Click OK to save the identity source.
Notes:
- Log in may also fail if an AD domain group has a nested group from a child domain. To resolve this issue, specify the child domain directly within vCenter Server instead of nesting the group within another group.
- In cases where the domain is listed, move the domain to the top of the list in the Default Domains window.
- Your users in AD may now be able to log into the vSphere Web Client using AD credentials. Be sure they specify domain\user in the login prompt.
- If the AD domain exists as a valid Identity, you may have basic permission issues within vCenter Server.
- If users/groups were specified within the Local OS as members of the Administrators group, these users will also have lost access to log into vCenter Server. The user specified during the install as the vCenter Server administrator should then be able to log into vCenter Server and grant permissions to the vCenter Server object as an administrator to allow the users to log in again.
- Verify that there is an alias listed in the identity source.
Additional Information
To be alerted when this document is updated, click the Subscribe to Article link in the Actions box
For more information, see:
Impact/Risks:
Caution: Specify the port 3268 for the Primary Server URL, which otherwise defaults to port 389. Allowing it to default to port 389 may impact login via SSO.