Users are not able to login to vcenter via domain ids

Products

• VMware vCenter Server

Issue/Introduction

Users are not able to log in to vcenter via domain IDs. The users are able to log in via SSO administrator quickly, but when trying from the domain ID and service, it's just loading. 

Environment

VMware vCenter Server 8.x

Cause

There is a high latency from the domain controllers that are configured for identity sources in the vcenter server.

Resolution

1. Identify the domain controllers by reviewing the identity sources configuration (ssh to vcenter server and run)

• /opt/vmware/bin/sso-config.sh -get_identity_sources

2. Check for the latency ( from va/log/vmware/sso directory)

• grep -A1 "LdapBindConnection" vmware-identity-sts-perf.log | awk '/PerfBucketKey/ {match($0, /providerInfo=([^]]+)/, a)} /adjustedAvg=/ {match($0, /adjustedAvg=([0-9]+)/, b); print "providerInfo=" a[1] ", adjustedAvg=" b[1]}'

3. Remove the domain controller with the higher latency by reconfiguring the identity sources.

• Take a snapshot of the vcenter server
• Log into the vSohere Client using  solution user account ( SSO)
• Navigate to Home>administration>Sigle Sign On>Configuration
• Select Identity Sources Tab
• Review the existing identity sources
• Remove and reconfigure it, removing the high-latency domain controller
• Restart the vcenter server services