Active Directory (AD) Users Unable to Log In to vCenter Server Due to Invalid LDAP Bind Credentials

Products

• VMware vCenter Server

Issue/Introduction

• Active Directory (AD) user logins are failing in vSphere Client.
• The identity source in vCenter SSO is configured as "Active Directory over LDAP"
• The following errors may be observed in the /var/log/vmware/likewise/Likewise.log:

  ERROR lwio: [0x#####] GSS-API error calling gss_init_sec_context: ##### (<null>)
  ERROR lwio: [0x#####] GSS-API error calling gss_init_sec_context: ##### (<null>)
  ERROR lwio: [0x#####] GSS-API error calling gss_init_sec_context: ##### (<null>)

  
  Note: For vCenter 7.X these entries are usually found in /var/log/vmware/messages as default local. This can however be reconfigured using the command # /opt/likewise/bin/lwsm set-log. To confirm the log location for vCenter 7.x, use the command:

  # /opt/likewise/bin/lwsm get-log

  For the default location, this command will respond with syslog: LOG_DAEMON, otherwise the path to the correct log will be shown. For vCenter 8.X the path is fixed.
  
  
• /var/log/vmware/sso/vmware-identity-sts.log contains an error stack similar to the following:

  [com.vmware.identity.interop.ldap.LdapErrorChecker] Error received by LDAP client: com.vmware.identity.interop.ldap.OpenLdapClientLibrary, error code: 49
  [com.vmware.identity.idm.server.ServerUtils] cannot bind connection: [ldap://#####.com, #####.#####@#####.com]
  [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldap://#####.com] because [Invalid credentials] therefore will not attempt to use any secondary URIs
  [com.vmware.identity.idm.server.provider.ldap.LdapWithAdMappingsProvider] Failed to retrieve upnSuffixes in AD over LDAP provider '<domain_suffix>'
  ccom.vmware.identity.interop.ldap.InvalidCredentialsLdapException: Invalid credentials

• In /var/log/vmware/sso/websso.log the following error can be found:

  {\"user\":\"#####\",\"client\":\"##.##.##.##\",\"timestamp\":\"##/##/#### ##:##:## GMT\",\"description\":\"User #####@##.##.##.## failed to log in with response code 401\",\"eventSeverity\":\"INFO\",\"type\":\"com.vmware.sso.LoginFailure\"}

Environment

• VMware vCenter Server 7.0.x
• VMware vCenter Server 8.0.x

Cause

This issue occurs when the credentials configured in the identity source, meant to be used by SSO to authenticate against the AD domain, are either invalid or have expired.
As a result, the LDAP bind request fails, causing any attempts by AD users to login in vCenter to fail

Resolution

To fix this issue, take the following steps:

1. Log in to the vCenter Server using the vSphere Client with a non-AD account that has administrative privileges (e.g. [e-mail]).
2. Navigate to Menu → Administration → Single Sign-On → Configuration → Identity Sources
3. Edit the existing LDAP identity source
4. Update the bind DN (Distinguished Name) user credentials with valid credentials.
5. Click Save to apply the changes.
6. Retry logging in with an AD user to confirm the issue is resolved.

Additional Information

If the LDAP bind credentials are invalid, the vCenter Server cannot query the LDAP directory, and all AD-based authentication will fail. LDAP error code 49 is commonly associated with invalid credentials.
If the credentials change (e.g., due to password expiration), the bind account must be updated in the vCenter Server configuration.
Refer to Single Sign-On Identity Source configuration using LDAPS in vSphere Client for more information.

The error code 49 may also occur in scenarios where the LDAP Identity Source is configured with a service account whose password has been changed, in Active Directory, but the new credentials have not been updated in the vCenter Single Sign-On (SSO) configuration, in this scenario, follow the below steps:

1. Log in to the vSphere Client as an administrator (e.g. [e-mail]).
2. Navigate to Administration → Single Sign-On → Configuration.
3. Under the Identity Sources tab, select the affected Active Directory (LDAP) or Active Directory (over LDAP) source.
4. Click Edit.
5. Update the Password field with the current, valid credentials for the configured service account.
6. Click Test Connection to verify the new credentials.
7. Click Save.

In other scenarios, where vCenter Server utilizes a non-interactive LDAP Simple Bind for authentication via the Secure Token Service (STS). Security platforms like Silverfort often intercept these binds to enforce multi-factor authentication (MFA) or specific security policies. Because the vCenter login process is non-interactive at the LDAP level, it cannot satisfy the secondary challenge, leading the Domain Controller to reject the bind request with an "Invalid Credentials" response.