Set password expiry policy for a specific SSO user in vCenter
search cancel

Set password expiry policy for a specific SSO user in vCenter

book

Article ID: 367383

calendar_today

Updated On:

Products

VMware vCenter Server 7.0 VMware vCenter Server 8.0 VMware vCenter Server

Issue/Introduction

Service accounts used for third-party integrations, such as backup tools (e.g., Veeam) or Telco Cloud Automation (TCA), often require passwords that do not expire. In the vCenter Server user interface, password expiry is a global parameter that affects all users.

This article provides instructions on using the dir-cli utility to configure a "never expires" attribute for specific Single Sign-On (SSO) accounts without modifying the global policy.

When a service account password expires, third-party integrations fail. The /var/log/vmware/sso/websso.log file contains errors similar to the following:

yyyy-mm-ddThh:mm:ss.mssZ ERROR websso[56:tomcat-http--18] [CorId=29b33506-52fe-42c1-96ad-451a7e609e5a] [com.vmware.identity.idm.server.IdentityManager] Failed to authenticate principal [<user_name>@<SSO_Domain>]. User password expired.

yyyy-mm-ddThh:mm:ss.mssZ INFO websso[56:tomcat-http--18] [CorId=29b33506-52fe-42c1-96ad-451a7e609e5a] [com.vmware.identity.idm.server.IdentityManager] Authentication failed for user [<user_name>@<SSO_Domain>] in tenant [<SSO_Domain>] in [23] milliseconds with provider [<SSO_Domain>] of type [com.vmware.identity.idm.server.provider.vmwdirectory.VMwareDirectoryProvider]

yyyy-mm-ddThh:mm:ss.mssZ ERROR websso[56:tomcat-http--18] [CorId=29b33506-52fe-42c1-96ad-451a7e609e5a] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: <user_name>, Domain: <SSO_Domain>}'

com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: <user_name>, Domain: <SSO_Domain>}

com.vmware.identity.idm.PasswordExpiredException: User account expired: {Name: <user_name>, Domain: <SSO_Domain>}
 

Environment

VMware vCenter Server

Cause

The vCenter Server UI only supports global password policy configuration. Individual account overrides for password expiration must be performed via the command-line interface using the dir-cli tool.

Resolution

Follow these steps to modify the password expiry attribute for a specific SSO user.

  1. Log in to the vCenter Server Appliance (VCSA) via SSH.
  2. Type shell to access the BASH shell.
  3. Run the following command to check the current password expiry status for the user:
    /usr/lib/vmware-vmafd/bin/dir-cli user find-by-name --account <Account Name>  --level 2
  4. To disable password expiry for the account, run:
    /usr/lib/vmware-vmafd/bin/dir-cli user modify --account <Account Name> --password-never-expires
  5. When prompted for a password, enter the credentials for administrator@vsphere.local (or the equivalent SSO administrator).
    • Note: Using the vCenter root password will result in an ERROR_LOGON_FAILURE (1326).
  6. To verify the change, rerun the command from Step 3. The output should display: Password never expires: TRUE
  7. (Optional) To re-enable password expiry for the user in the future, run:
    /usr/lib/vmware-vmafd/bin/dir-cli user modify --account <Account Name> --password-expires

 

Additional Information

For more functions of this utility, refer to the dir-cli Command Reference documentation.

Example snippets: 

Set the password expiry to "never":

# /usr/lib/vmware-vmafd/bin/dir-cli user modify --account test --password-never-expires
Enter password for administrator@vsphere.local:
Password set to never expire for [<User_Name>].

 

Validation: 

#  /usr/lib/vmware-vmafd/bin/dir-cli user find-by-name --account <User_Name> --level 2
Enter password for administrator@vsphere.local:
Account: <User_Name>
UPN: <User_Name>@<SSO_DOMAIN>
Account disabled: FALSE
Account locked: FALSE
Password never expires: TRUE
Password expired: FALSE
Password expiry: N/A

 
Powered by Wolken Software