Failed in account linking using certificate SAN error for Smart Card or CAC login to vCenter

Products

• VMware vCenter Server

Issue/Introduction

You can set up your environment to require smart card authentication when a user connects to a vCenter Server from the vSphere Client..

The vCenter server appliance "/var/log/vmware/sso/websso.log" has the error when a User attempts to login to vCenter Server using a Smart Card or CAC (Common Access Card).

"Ignoring exception while iterating providers: Failed in account linking using certificate SAN"

Environment

vSphere 7

vSphere 8

Cause

The Smart Card User Authentication Certificate Subject Alternative Name (SAN) Principal Name does not match the User Active Directory domain or the Active Directory User account userPrincipalName.

Resolution

• Set Alternative UPN Suffixes in Active Directory Domains and Trusts properties to match the Smart Card User Authentication Certificate Subject Alternative Name (SAN) Principal Name
  
  
  • 
    
    
  • 
    
    
    
• Set User Attributes userPrincipalName on the User Account in Active Directory Users and Computers to match the Certificate Subject Alternative Name (SAN) Principal Name.
  
  
  OR
  
  
• Re-issue the Smart Card User Authentication Certificate so that the Subject Alternative Name (SAN) Principal Name matches the Active Directory User's account userPrincipalName.
  
  OR
  
  
• Use Federation vCenter Server supports federated authentication to sign in to vCenter Server.
  
  Identity Federation allows us to attach vCenter Server to enterprise identity providers. vCenter Server participates in the same centralized corporate processes, such as onboarding and termination. It also means that users can use the same methods to log into vCenter Server as they do their desktops and the cloud. This includes MFA & 2FA solutions as well.

Additional Information

Verify that an enterprise Public Key Infrastructure (PKI) is set up in your environment, and that certificates meet the following requirements:

• A User Principal Name (UPN) must correspond to an Active Directory account in the Subject Alternative Name (SAN) extension.
• The certificate must specify Client Authentication in the Application Policy or Extended Key Usage field or the browser does not show the certificate.

Add an Active Directory identity source to vCenter Single Sign-On.

Note, 

Deprecation of SSPI, CAC and RSA: In a future major vSphere release, VMware plans to discontinue support for Windows Session Authentication (SSPI) used as
part of the Enhanced Authentication Plug-in, Smart Card support, and RSA SecurID for vCenter Server. In place of SSPI, Smart Card, or RSA SecurID, users and
administrators can configure and use Identity Federation with a supported Identity Provider to sign in to their vCenter Server system.