Unable to reset local user credentials when vIDM is enabled on NSX Manager

Products

• VMware NSX
• VMware NSX-T Data Center

Issue/Introduction

Symptoms:
Attempting to reset the credentials of a local user will not succeed when logging in and out. 

When user tried to renew/reset the local user password upon its expiry, the login page renew option does not appear and hence password cannot be renewed.

This problem will be hit only if the admin tries to reset the password for a local user

Logs:
2021-12-09T18:45:06.359Z INFO https-jsse-nio-10.191.231.103-443-exec-4 PAMAuthenticationProvider 5242 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Local auth for audit unsuccessful, trying other auth methods.
2021-12-09T18:45:06.360Z INFO https-jsse-nio-10.191.231.103-443-exec-4 PasswordExpirationFailureHandler 5242 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Exception is not PasswordExpiredException

Log location /var/log/proxy/reverse-proxy.log

Environment

VMware NSX 4.x
VMware NSX-T Data Center 3.x

Cause

PasswordExpiredException is properly thrown; however, immediately after, since vIDM is enabled, the OAuth2 filter fires. Since the PAM provider doesn't actually throw an authentication failure event, by the time the PasswordExpirationFailureHandler is called, it will process the exception thrown by the OAuth2 provider (which is a BadCredentials Exception)

Resolution

Issue is resolved in NSX 3.2.3 and 4.1.0

Workaround:
VIDM should be disabled before admin resets the password for a local user. After the local user changes the password, VIDM should be re-enabled.

Additional Information

If the issue persists after trying this workaround, please open a support request with Broadcom and provide this KB reference.

To contact Broadcom support or open a case, please refer:  https://knowledge.broadcom.com/external/article/206567/contact-broadcom-support.html