Symptoms:
When you log in to the vCenter Server in the vSphere Web Client, you experience these symptoms:
- When you log in using Use Windows Sessions Authentication in the vSphere Web Client, you see the error:
User name and password are required
- In the %appdata%..\..\Local\VMware\CIP\csd\logs\csd.log file, you see entries similar to:
<YYYY-MM-DD>T<time> [TRIV] Message recieved [50100]: {"method":"getADUserName","requestId":"7","componentId":"sspi","createInstance":"true","sessionId":"EfmR-fTms-mGFQ-Bplj"} </time>
<YYYY-MM-DD>T<time> </time>[INFO] Request 7 - [sspi: 8088-jT99-8gEX-Xsia].getADUserName: Received.
<YYYY-MM-DD>T<time> </time>[TRIV] Message sent [50100]: {
"type": "result",
"statusCode": "OK",
"sessionId": "EfmR-fTms-mGFQ-Bplj",
"requestId": "7",
"requestComponentId": "sspi",
"requestObjectId": "8088-jT99-8gEX-Xsia",
"result": "<domain>\<user>",
"isFinal": "true"
}
[ YYYY-MM-DD <time></time>] [TRIV] Message recieved [50100]: {"providerName":"Negotiate","target":"HTTP/<vCenter_Server_FQDN>","method":"initialize","requestId":"11","componentId":"sspi","objectId":"8088-jT99-8gEX-Xsia","createInstance":"true","sessionId":"EfmR-fTms-mGFQ-Bplj"}
<YYYY-MM-DD>T<time> [INFO] Request 11 - [sspi: 8088-jT99-8gEX-Xsia].initialize: Received. </time>
<YYYY-MM-DD>T<time> 09:55:23] [TRIV] Message sent [50100]: { </time>
"type": "result",
"statusCode": "OK",
"sessionId": "EfmR-fTms-mGFQ-Bplj",
"requestId": "11",
"requestComponentId": "sspi",
"requestObjectId": "8088-jT99-8gEX-Xsia",
"result": "YIISAgYGKwYBBQUCoIIR9jCCEfKgMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwIC... ...",
"isFinal": "true"
}
- In the %appdata%..\..\Local\VMware\CIP\ui\sessions\session_0000\logs\login_xxxx.log file, you see entries similar to:
<YYYY-MM-DD>T<time> Log initialized for websso login
</time><YYYY-MM-DD>T<time> onAppInit : using CIP Build 6.0.0.2488235
<YYYY-MM-DD>T<time> enableSspi : getting the userNamer for this logged on User
<YYYY-MM-DD>T<time> onGetADUserName : Username is <domain>\<user>
<YYYY-MM-DD>T<time> Login started for user : <domain>\<user>
<YYYY-MM-DD>T<time> Using Windows SSPI Authentication to login. spn is : [ HTTP/<vCenter_Server_or_Platform_Services_Controller_FQDN> ]
<YYYY-MM-DD>T<time> OnInitializeSSPI : base64SSPIToken is : YIISAgYGKwYBBQUCoIIR9jCCEfKgMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwIC
...
<YYYY-MM-DD>T<time> Error received during negotiation. Msg : [ Bad Request ]
<YYYY-MM-DD>T<time> did the login fail? if using SSPI - ensure the logged in user can login to the SSO service
<YYYY-MM-DD>T<time> Login started for user : <domain>\<user>
<YYYY-MM-DD>T<time> Using username password to login </time></time></time></time></time></time></time></time></time></time>
- In the %ProgramData%/VMware/vCenterServer/runtime/VMwareSTSService/logs/ localhost_access_log.YYYY-MM-DD.txt or /storage/log/vmware/sso/ localhost_access_log.YYYY-MM-DD.txt file, you see entries similar to:
127.0.0.1 - - [<YYYY-MM-DD>T<time> -0700] "GET /websso/SAML2/SSO/vsphere.local?SAMLRequest=zZTNbtswEIT... HTTP/1.1" 400 -
127.0.0.1 - - [ </time><YYYY-MM-DD>T<time> -0700] "GET /websso/SAML2/SSO/vsphere.local?SAMLRequest=zZTNbtswEIT... HTTP/1.1" 200 24371 </time>
- In the %ProgramData%/VMware/vCenterServer/runtime/VMwareSTSService/logs/ websso.log file or /storage/log/vmware/sso/ websso.log file, you see entries similar to:
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 INFO com.vmware.identity.SsoController] Server SPN is HTTP/<vCenter_Server_or_Platform_Services_Controller_FQDN>
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 DEBUG com.vmware.identity.samlservice.DefaultIdmAccessorFactory] DefaultIdmAccessorFactory constructor
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 DEBUG com.vmware.identity.samlservice.DefaultIdmAccessorFactory] DefaultIdmAccessorFactory getIdmAccessor
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 DEBUG com.vmware.identity.samlservice.impl.CasIdmAccessor] CasIdmAccessor constructor called
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 DEBUG com.vmware.identity.samlservice.impl.CasIdmAccessor] setTenant: vsphere.local
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 DEBUG com.vmware.identity.samlservice.impl.CasIdmAccessor] getBrandName
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 INFO com.vmware.identity.SsoController] Accessing Tenant vsphere.local, brand name string null
[ <YYYY-MM-DD>T<time> </time>-07:00 tomcat-http--23 DEBUG com.vmware.identity.samlservice.DefaultIdmAccessorFactory] DefaultIdmAccessorFactory constructor
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 DEBUG com.vmware.identity.samlservice.DefaultIdmAccessorFactory] DefaultIdmAccessorFactory getIdmAccessor
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 DEBUG com.vmware.identity.samlservice.impl.CasIdmAccessor] CasIdmAccessor constructor called
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 DEBUG com.vmware.identity.samlservice.impl.CasIdmAccessor] setTenant: vsphere.local
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 DEBUG com.vmware.identity.samlservice.impl.CasIdmAccessor] getLogonBanner
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 INFO com.vmware.identity.SsoController] Accessing Tenant vsphere.local, logon banner string null
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 DEBUG com.vmware.identity.SecurityRequestWrapperFilter] X-Forwarded-Proto set to https, so encapsulate it with secure request.
...
[ YYYY-DD-MM>T<time>-07:00</time> tomcat-http--23 DEBUG com.vmware.identity.SecurityRequestWrapperFilter] X-Forwarded-Proto set to https, so encapsulate it with secure request.
[ YYYY-DD-MM>T<time>-07:00</time> Thread-4 DEBUG com.vmware.identity.session.SessionCleanupWrapper] Check existing sessions
[ YYYY-DD-MM>T<time>-07:00</time> Thread-4 DEBUG com.vmware.identity.session.impl.SessionManagerImpl] Returning all sessions
- In the %ProgramData%/VMware/vCenterServer/runtime/VMwareSTSService/logs/catalina.YYYY-MM-DD.log file, you see entries similar to:
<YYYY-MM-DD>T<time> INFO [tomcat-http--35] org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP request header
</time>Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
<YYYY-MM-DD>T<time></time> INFO [tomcat-http--19] org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP request header
Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
<YYYY-MM-DD>T<time></time> INFO [tomcat-http--6] org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP request header
Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
<YYYY-MM-DD>T<time></time> INFO [tomcat-http--15] org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP request header
Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
<YYYY-MM-DD>T<time></time> INFO [tomcat-http--23] org.apache.coyote.http11.AbstractHttp11Processor.process Error parsing HTTP request header
Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.