Unable to add host due to incorrect username or password.

Products

• VMware vCenter Server

Issue/Introduction

Hosts may sometimes need to be removed from the vCenter Server inventory, especially if they become disconnected or experience connectivity issues. However, when attempting to re-add these hosts to the vCenter inventory, administrators might encounter an error stating: "Unable to add host due to incorrect username or password."

Environment

VMware vCenter Server 7.x

ESXi 7.x

Cause

less /var/run/log/vpxa logs: The vpxa (VMware vCenter Server Agent) is responsible for communication between the vCenter Server and the ESXi host. This log entry suggests that the vpxa agent is having trouble selecting the correct protocol version to authenticate with the host agent (hostd). 

error vpxa[18540409] [Originator@6876 sub=hostdcnx] Failed to select version for authenticating to host agent

less /var/run/log/hostd logs: The hostd (Host Daemon) manages most of the operations on the ESXi host. This warning indicates that hostd is unable to look up the vpxuser account, which is a special user created by vCenter to manage the host. This could happen if the vpxuser account has been deleted, corrupted, or if there are permission issues.

warning hostd[18540280) [Originator 6076 sub-UserDirectory opID-s90520nal User lookup failed for 'vpxuser'

less /var/run/log/vmkernel logs: The vmkernel log entry points to an admission control failure related to esxtokend, which is the ESXi token daemon responsible for managing secure tokens for authentication. An issue here might indicate problems with token-based authentication on the host, potentially leading to the failed authentication error when trying to add the host back to vCenter.

Admission failure in path: host/vim/vmvisor/esxtokend:esxtokend

Resolution

Restart the ESXi Token CPS Service.

Steps to implement:

1. /etc/init.d/esxTokenCPS restart
2. /etc/init.d/vpxa stop
3. Reconnect ESXi to vCenter