User accounts are prompted to log in despite increasing the vSphere Client session timeout period

Products

• VMware vCenter Server

Issue/Introduction

This article offers steps to identify and troubleshoot issues related to extending the vSphere Web Client session timeout.

• By default, VMware vSphere Web Client 5.1 ends sessions after 30 minutes of idle time. Starting from the vSphere version 5.5, the timeout period was extended to 120 minutes.
• Both the SSO and the AD user accounts continue to be prompted for login regardless of extending the timeout value as seen below
  
  
  
  

Cause

The 'webclient.properties' configuration file in the VCSA for the webclient service may be incomplete when reviewed.

Resolution

Shared below are the steps considered to isolate and remediate the noticed behavior.

1. Take appropriate snapshots of the vCenter or vCenters if in ELM.

2. SSH to vCenter via root.

3. Stop the VPXD service.
   
   service-control --stop vmware-vpxd

4. Backup the existing vpxd.cfg file prior to making any changes.
   
   cp /etc/vmware-vpx/vpxd.cfg /root/vpxd.cfg_bkp

5. Open the vpxd.cfg file using a text editor like vi file editor.
   
   vi /etc/vmware-vpx/vpxd.cfg

6. Add the following <soap> elements within the <vmacore> </vmacore> tags as shown below.
   
     <soap>
    <sessionTimeout>240</sessionTimeout>
  </soap>

7. Assuming that the steps in "Increasing the VMware vSphere Web Client session timeout period" were followed to increase the timeout parameter in webclient.properties, verify the following:

   • /etc/vmware/vsphere-ui/webclient.properties
     
     

   • /etc/vmware-vpx/vpxd.cfg
     
     

8. Start the VMware vCenter Server service and restart the vSphere Client service.
   
   service-control --start vmware-vpxd
service-control --restart vsphere-ui  
   
   Note: For vSphere 6.5 and earlier, run:
   service-control --restart vsphere-client

9. To verify, check in Configure tab > Advanced Settings > Filter for the setting named 'vpxd.httpClientIdleTimeout' and accordingly increase as intended.

10. If the issue continues despite completing the above, the affected VCSA exhibiting this behavior likely has incomplete content in the webclient.properties file. If possible, it is recommended to obtain a file from a working vCenter. Refer to the Additional Information section for examples of an affected and working vCenter webclient.properties file.

 

Additional Information

Example

Affected VCSA webclient.properties content:

#Timestamp
live.updates.lists.enabled=true
profiling.propertyProviderAdapterTimeThreshold=1500
live.updates.objectstate.enabled=true
installation.id=######
sso.active.sessions.max=150
profiling.queryBatchTimeThreshold=7000
dataservice.timeoutSeconds=120
session.timeout=240
alarms.refresh.rate=60
dataservice.connectionTimeoutSeconds=10
live.updates.navtree.enabled=true
connecton.state.check.interval=10
ovf.download.timeout=14400000
live.updates.enabled=true
sso.pending.password.expiration.notification.days=30
live.updates.alarms.enabled=true
portletsVmSummaryView.enabled=true
profiling.dataAdapterTimeThreshold=3000
webclient.properties (END)

Unaffected VCSA webclient.properties content

# Note: unless otherwise noted, changes in this file require a server restart or a new client session.
# To change the Help url reference, change the value to the required url.
# If you are deploying a Help package locally on the vSphere Web Client system, then provide a relative url.
# For example, if you deployed help.war, you would specify help.url=/help/
#help.url=http://techpubs.vmware.com/
# Flags that enable the live refresh in different areas of the client.
live.updates.enabled = true
live.updates.alarms.enabled = true
live.updates.navtree.enabled = true
live.updates.lists.enabled = true
live.updates.objectstate.enabled = true
# Web client session timeout in minutes, default is 120, i.e. 2 hours
session.timeout = 240
....
...
...
# If the total time consumed by all queries in a given batch exceeds
# this time, a warning will be logged.
# The value is in milliseconds
profiling.queryBatchTimeThreshold=7000
# Data Service Data Adapter Time Threshold
# If an adapter's execution exceeds this time, a warning will be logged.
# The value is in milliseconds
profiling.dataAdapterTimeThreshold=3000
# Data Service Property Provider Adapter Time Threshold
# If a PropertyProviderAdapter's execution exceeds this time,
# a warning will be logged. The value is in milliseconds
profiling.propertyProviderAdapterTimeThreshold=1500
installation.id=#####
webclient.properties (END)