AD users are unable to login to vcenter
Article ID: 407965
Updated On:
Products
Issue/Introduction
*Adding the identity source AD over ldap but its failing.
*Curl test over port 389 shows connected.
*Forward and reverse lookup is working fine for both the domain controllers.
Error recieved while adding AD over LDAP-
Caused by: Strong(er) authentication required
Environment
vcenter 7.x
vcenter 8.x
Cause
The "Strong(er) authentication required LDAP error [code: 8]" observed in the vmware-identity-sts.log is a direct error message originating from the Active Directory server. This error occurs when the vCenter Server, attempting to authenticate a user or service account (such as a backup service account), issues an LDAP bind request that does not meet the Active Directory server's required level of authentication security.
LDAP error code 8 explicitly signifies that the Active Directory server demands a stronger authentication method than what the vCenter Server is providing. Given that the vCenter Server is configured for "Active Directory over LDAP" (which typically implies an unencrypted, non-SSL/TLS LDAP connection), this error directly indicates a mismatch between the vCenter's client-side authentication method and the Active Directory server's enforced security policies.
websso.log >>
WARN sts[41:tomcat-http--2] [com.vmware.identity.interop.ldap.LdapErrorChecker] Error received by LDAPclient: com.vmware.identity.interop.ldap.OpenLdapClientLibrary, error code: 8
WARN sts[41:tomcat-http--2] [com.vmware.identity.idm.server.ServerUtils] cannot bind connection: [ldap://xxxxx]
ERROR sts[41:tomcat-http--2] [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldap://xxxx] because [com.vmware.identity.interop.ldap.StrongAuthRequiredLdapException] with reason [Strong(er) authentication required] therefore will try to attempt to use secondary URIs, if applicable
Resolution
If customer wants to use LDAP instead of LDAPS then the workaround is to create a new Group Policy (or edit an existing one) and configure the following settings under:
Computer Configuration > Policies > Security Settings > Local Policies > Security Options.
Domain controller: LDAP server channel binding token requirements – “When Supported”
Domain controller: LDAP server signing requirements – “None”
Domain controller: LDAP server signing requirements Enforcement – “Disabled”
Network security: LDAP client encryption requirements – “Negotiate Sealing”
Network security: LDAP client signing requirements – “Negotiate Signing”
Once configured, do a gpupdate /force and reboot the AD server, then vSphere LDAP configuration should be working again.
Feedback
