Unable to login without RSA SecurID after vCenter Server upgrade

Products

• VMware vCenter Server

Issue/Introduction

This issue occurs after upgrading a vCenter Server appliance running 7.0 Update 3 to 8.0 Update 3.

When viewing the login page for vSphere Client for the upgraded vCenter Server, the login button is disabled before and after inputting username and password. There is also an RSA SecurID checkbox displayed above the login button that cannot be clicked.

Environment

vCenter Server 8.x

Cause

Stale RSA data in the vCenter Server appliance or the web browser.

Resolution

Solution A)

Clear web browser cache or open a new private/incognito window in web browser.

Navigate to the vSphere Client login page and try logging in once more.

 

Solution B)

Confirm if RSA SecurID logins can be disabled.

SSH into the upgraded vCenter Server appliance and deactive RSA with:  

sso-config.sh -t <tenantName> -set_authn_policy -securIDAuthn false

-:- Note - successfully disabling RSA SecurID may return similar output to the following example:

Setting authentication policy on tenant :vsphere.local

Authentication policy is set successfully

Authentication policy on tenant : 'vsphere.local' :

IsPasswordAuthEnabled: true

IsWindowsAuthEnabled: true

IsTLSClientCertAuthnEnabled: false

IsSecurIDAuthnEnabled: false

revocationCheckEnabled: true

use0CSP: false

useCRLAsFailover: false

Alternative OCSP responders:

useCertCRL: true

CRLUrl: UndefinedConfig

 

Identity source-specific policy for: 'vsphere.local' is not set. Will use tenant Authentication policy.

Identity source-specific policy for: 'localos' is not set. Will use tenant Authentication policy.