Set password expiry policy for a specific SSO user in vCenter
search cancel

Set password expiry policy for a specific SSO user in vCenter

book

Article ID: 367383

calendar_today

Updated On:

Products

VMware vCenter Server 7.0 VMware vCenter Server 8.0 VMware vCenter Server

Issue/Introduction

  • Service accounts used for third-party integrations (such as Veeam or Telco Cloud Automation) typically require non-expiring passwords to function without interruption. The vCenter Server user interface only allows password expiration to be set as a global policy, which affects all users.
  • dir-cli command-line utility can be used to set a "never expires" attribute on specific Single Sign-On (SSO) accounts, keeping the global password policy intact.
  • If a service account password expires, connected third-party integrations will fail. The /var/log/vmware/sso/websso.log file contains errors similar to the following:
yyyy-mm-ddThh:mm:ss.mssZ ERROR websso[56:tomcat-http--18] [CorId=######] [com.vmware.identity.idm.server.IdentityManager] Failed to authenticate principal [<user_name>@<SSO_Domain>]. User password expired.
yyyy-mm-ddThh:mm:ss.mssZ INFO websso[56:tomcat-http--18] [CorId=######] [com.vmware.identity.idm.server.IdentityManager] Authentication failed for user [<user_name>@<SSO_Domain>] in tenant [<SSO_Domain>] in [23] milliseconds with provider [<SSO_Domain>] of type [com.vmware.identity.idm.server.provider.vmwdirectory.VMwareDirectoryProvider]
yyyy-mm-ddThh:mm:ss.mssZ ERROR websso[56:tomcat-http--18] [CorId=######] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: <user_name>, Domain: <SSO_Domain>}'
com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: <user_name>, Domain: <SSO_Domain>}
com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: <user_name>, Domain: <SSO_Domain>}

Environment

VMware vCenter Server

Cause

The vCenter Server UI only supports global password policy configuration. Individual account overrides for password expiration must be performed via the command-line interface using the dir-cli tool.

Resolution

Log in to the vCenter Server Appliance (VCSA) via SSH and type shell to access the BASH command line.

  1. Verify the existing password expiry setting by running:
    /usr/lib/vmware-vmafd/bin/dir-cli user find-by-name --account <Account Name>  --level 2
     
  2. Apply the "never expires" attribute to the account with the following command:
    /usr/lib/vmware-vmafd/bin/dir-cli user modify --account <Account Name> --password-never-expires
     
  3. When prompted, enter the password for [email protected] (or an equivalent SSO administrator). Note: Using the vCenter root password will result in an ERROR_LOGON_FAILURE (1326).

  4. Rerun the command from the second step to verify the change. The output must display: Password never expires: TRUE.
     
  5. To optionally re-enable password expiration for the account in the future, execute:
    /usr/lib/vmware-vmafd/bin/dir-cli user modify --account <Account Name> --password-expires

Additional Information

For more functions of this utility, refer to the dir-cli Command Reference documentation.

Example snippets: 

Set the password expiry to "never":

# /usr/lib/vmware-vmafd/bin/dir-cli user modify --account <User_Name> --password-never-expires
Enter password for [email protected]:
Password set to never expire for [<User_Name>].

Validation: 

#  /usr/lib/vmware-vmafd/bin/dir-cli user find-by-name --account <User_Name> --level 2
Enter password for [email protected]:
Account: <User_Name>
UPN: <User_Name>@<SSO_DOMAIN>
Account disabled: FALSE
Account locked: FALSE
Password never expires: TRUE
Password expired: FALSE
Password expiry: N/A

 
Powered by Wolken Software