vCenter Server SSO account login failed with error: User account is locked. Please contact your administrator

Products

• VMware vCenter Server 7.0
• VMware vCenter Server 8.0
• VMware vCenter Server

Issue/Introduction

• Authentication with SSO account  [email protected] on vSphere Client returns the error:
  User account is locked. Please contact your administrator 

• Executing the following command to view system logs on vCenter Server(VCSA) displays : 
  Command :  journalctl -b 0 | grep BadUsernameSessionEvent 
  Output :
  MMM DD HH:MM:SS <vcenter_FQDN> vpxd[####]: Event [#########] [1-1] [YYYY-MM-DDTHH:MM:SSZ] [vim.event.BadUsernameSessionEvent] [error] [[email protected]] [] [#########] [Cannot login [email protected]@<IP_Address>]

Environment

VMware vCenter Server 7.0.x

VMware vCenter Server 8.0.x

 

Cause

• The SSO administrator account password was changed and has reached the maximum number of failed login attempts due to machines attempting to authenticate with the older credentials triggering the account lockout policy.
• The number of failed authentication attempts and the IP address of the machines attempting to authenticate can be identified using the following command : 

journalctl_-b| grep BadUsernameSessionEvent  |grep [email protected]| awk '{print $17}'|sort|uniq -c|sort

Sample output :

<number_of_failed_attempts> [email protected]@<IP_Address>]
<number_of_failed_attempts> [email protected]@<IP_Address>]

Resolution

1. Connect to the VCSA using SSH with the root account
2. Run the following command to identify the IP addresses of machines attempting to authenticate with outdated credentials:
   grep BadUsernameSessionEvent journalctl_-b--0.txt | grep [email protected] | awk '{print $17}' | sort | uniq -c | sort

3. Use the vdcadmintool utility on the VCSA to reset the account password. Follow the detailed instructions provided in this article: Resetting forgotten vCenter SSO password - "User account is locked. Please contact your administrator"
4. Update the [email protected] account password on the machines identified to be using the outdated credentials.