vCenter login slowness using LDAP SSO Identity Provider

Products

• VMware vCenter Server

Issue/Introduction

• Logins to vCenter Server using Active Directory (AD) credentials take 2 minutes or longer.
• Operations relying on authentication, such as Veeam backups, fail with timeout errors.
• Logins using local accounts (e.g., [e-mail]) are not affected.
• After running “lw-measure" command to start recording communication between the VCSA and the DCs watched the events using “tail -f nohup.out”.
  • Using the lw-measure tool to detect latency between vCenter Server and Active Directory domain controllers
    • From KB Slow logins to vCenter Server Appliance with an Active Directory joined PSC.
    • Receiving errors of lsalookupnames2 and lsaopenpolicy2 failed for each of the four DCs.
    • The fields where the DNs are supposed to be listed are listed as “null”.

Environment

vCenter 7.x

vCenter 8.x

Cause

This issue occurs when the vCenter Identity Source is configured using the root domain name instead of specific hostnames. When pointing to the root domain, vCenter queries DNS for all A records (Domain Controllers) and may randomly attempt to connect to firewalled, unreachable, or high-latency DCs, leading to authentication timeouts.

Resolution

Configure Specific Domain Controllers:

1. Navigate to Administration > Single Sign-On > Configuration.
2. Edit the Identity Source.
3. Change the Connect to option to Specific Domain Controllers.
4. Add the FQDNs of known healthy DCs that the VCSA has no issues communicating with (e.g., ldap://dc01.example.com:389).
   1. If when attempting to save the configuration you receive an error similar to “cannot configure identity source due to failed to probe provider connectivity [UR… caused by: can’t contact ldap server” remove the secondary DC URL listed and try to save with only one DC. If that saves successfully you can test the other DC(s) by replacing the single URL DC FQDN with one of the others and attempt to save. This can be done for the remaining DCs to test for each.
5. Save the configuration and verify login performance.

 

If desiring to return back to using the root domain as URL for round robin use of multiple domain controllers do the following.

1. Test network communication between the VC and the DCs currently failing in order to try and determine the cause of the communication issues and resolve those.
2. Once communication issues are resolved change the LDAP IdP configuration URL back to the domain for round.