SDDC Manager 5.2.1.x Passes Incorrect Credentials for vCenter in Shared SSO Domain During Inventory Sync

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

During an inventory sync in a VMware Cloud Foundation (VCF) environment with a shared SSO domain, SDDC Manager may fail to authenticate against a vCenter Server. This occurs because the SDDC Manager incorrectly attempts to use credentials from a different Single Sign-On (SSO) domain or VI workload domain instead of the correct Management Domain credentials.

The following errors are observed in /var/log/vmware/vcf/operationsmanager/operationsmanager.log:

YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,<ID>,e4db] [c.v.e.s.c.c.v.vsphere.VsphereClient,pool-10-thread-1] Failed to connect to https://<VCENTER_FQDN>:443/sdk java.util.concurrent.ExecutionException: (vim.fault.InvalidLogin) {faultCause = null,faultMessage = null}Caused by: com.vmware.vim.binding.vim.fault.InvalidLogin: Cannot complete login due to an incorrect user name or password.
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,<ID>,e4db] [c.v.e.s.c.c.v.vsphere.VcManagerBase,pool-10-thread-1] Cannot complete login due to incorrect credentials: <VCENTER_FQDN>, administrator@<WRONG_SSO_DOMAIN>.

Environment

SDDC Manager 5.2.1.x 

Cause

The issue is caused by the order in which SDDC Manager retrieves credentials from the internal platform database. In specific configurations involving shared SSO domains, the API response returns the VI Domain PSC (Platform Services Controller) credentials as the first object, ahead of the Management Domain credentials. SDDC Manager consumes the first object returned, resulting in an Unauthenticated or InvalidLogin error when attempting to connect to the Management vCenter.

Debug logs show the credential query returning multiple entries:

YYYY-MM-DDTHH:MM:SS DEBUG [vcf_om,<ID>,2a5b] [c.v.v.p.helper.CredentialHelper,om-exec-11] Size from Credentials query API 2
...
YYYY-MM-DDTHH:MM:SS ERROR [vcf_om,<ID>,e4db] [c.v.v.s.https.vapi.VapiClientFactory,pool-10-thread-1] Exception occurred during vAPI invocation
java.util.concurrent.ExecutionException: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated)

Resolution

This issue is permanently resolved in SDDC Manager version 5.2.3. We recommend upgrading to this version or higher to address the behavior.

If an immediate upgrade is not possible, please open a support ticket with Broadcom to discuss a workaround.

Additional Information

The internal API response is sensitive to the database record insertion order.
By deleting and re-inserting the Management Domain credentials, they become the primary object returned during the inventory sync process, allowing the VsphereClient to authenticate successfully using the correct SSO context.