Unable to Log In to HCX Manager After Service Account Update

Products

• VMware HCX

Issue/Introduction

After modifying the Service Account for HCX Manager registration with vCenter via HCX Manager Appliance (port 9443) under Configuration > vCenter Server. Users experience HCX Manager login failures with the following error message:

"Invalid Username or password, or too many active sessions"

The HCX web.log file located at /common/logs/admin reports the following error:

YYYY-MM-DD HH:MM:SS.SSS UTC [https-jsse-nio-8443-exec-3, , , TxId: ] INFO  c.v.i.token.impl.SamlTokenImpl- SAML token for SubjectNameId [value=<username>@<domain>, format=http://schemas.xmlsoap.org/claims/UPN] successfully parsed from XML

[...]

YYYY-MM-DD HH:MM:SS.SSS UTC [https-jsse-nio-8443-exec-9, , , TxId: ] WARN  c.v.vchs.hybridity.api.LoginUtil- Failed to get domain and alias map
com.vmware.vim.sso.admin.exception.NoPermissionException: null
        at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.execute(VmomiClientCommand.java:161)
        at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.executeEnsuringDomainErrorIs(VmomiClientCommand.java:217)
        at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.executeEnsuringDomainErrorIs(VmomiClientCommand.java:194)
        at com.vmware.vim.sso.admin.client.vmomi.impl.IdentitySourceManagementImpl.get(IdentitySourceManagementImpl.java:142)

Environment

VMware HCX

Cause

This issue occurred because the updated Service Account lacks the necessary permissions, leading to SSO authentication failures and an inability to retrieve domain and alias mappings.

Resolution

Ensure the Service Account has the necessary SSO permissions to access identity sources and retrieve domain mappings. Without these privileges, HCX Manager authentication may fail, preventing successful login.

Workaround:

Update the Service Account to the local vCenter account [email protected] for vCenter registration via HCX Manager Appliance (port 9443) under Configuration > vCenter Server. For detailed account and role requirements, refer to Broadcom's official HCX documentation.

HCX Manager User Account and Role Requirements