Error: Call to Directory Service Failed for Active Directory Users in VMware Identity manager.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Active Directory users may experience login failures when accessing VMware Aria products or NSX. The following symptom appears on the login screen: ERROR call to Directory Service Failed.

• The local vIDM admin account(s) can still successfully authenticate to vIDM.
• Test connection to AD fails from vIDM.
• Directory Sync fails with the error Response from connector: Failed to complete dry run.

The /opt/vmware/horizon/workspace/logs/connector-dir-sync.log file will report the following error:

Caused by: com.vmware.horizon.directory.DirectoryServiceException: Problem connecting to directory.
..
Caused by: com.vmware.horizon.directory.ldap.exceptions.DirectoryConnectionException: Could not connect to the Domain Controller.
..
Caused by: javax.naming.CommunicationException: simple bind failed: ####.####.####.####:####
..
Caused by: javax.net.ssl.SSLHandshakeException
..
Caused by: java.security.cert.CertificateException

Or:

com.vmware.horizon.directory.ldap.dc.service.DirectoryConnectService - AD connection failed for <domain-controller>:<port>
com.vmware.horizon.directory.ldap.exceptions.DirectoryConnectionException: Could not connect to the Domain Controller.
..
Caused by: javax.naming.CommunicationException: <domain-controller>:<port>
        at com.sun.jndi.ldap.Connection.<init>(Connection.java:233) ~[?:1.8.0_292]
..
Caused by: java.net.ConnectException: Connection timed out (Connection timed out)
        at java.net.PlainSocketImpl.socketConnect(Native Method) ~[?:1.8.0_292]

Environment

VMware Identity Manager 3.3.x

Cause

This issue can occur due to the following reasons:

• An SSL/TLS handshake failure due to an incorrect or expired root Active Directory CA certificate.
• Invalid or expired Bind User credentials.
• A misconfigured Base DN for AD integration.
• Network or firewall issues blocking communication with the Domain Controller.

Resolution

1. Validate Directory Configuration: Navigate to Identity & Access Management > Directories in the Administration Console. Verify the Base DN, Bind DN, and Bind user credentials, then save the configuration.
2. Verify Network Connectivity: Use standard connectivity tools (e.g., openssl or curl) from the vIDM appliance to the Domain Controller to confirm port availability (389/636/3268/3269).
3. Check for SSL/TLS Trust Issues: Inspect /opt/vmware/horizon/workspace/logs/connector-dir-sync.log. If the log contains the message Could not connect to the Domain Controller followed by javax.net.ssl.SSLHandshakeException, update the Active Directory root certificate in vIDM by following the article: Error: "Call to Directory service failed" while trying to access Identity manager using AD user credentials.
4. Directory Sync: Re-initiate the Directory Sync in the vIDM administrative interface to refresh the connection.