Authentication for AD users fails with error "Invalid credentials" on the vCenter Server due to LDAP server being unreachable

Products

• VMware vCenter Server

Issue/Introduction

• Attempts to authenticate on vCenter Server(VCSA) using Active Directory (AD) credentials is failing with "Invalid credentials".
• On logs, we see the below error: less /var/log/vmware/sso/ssoAdminServer.log :

YYYY-MM-DDTHH:MMM:SS ERROR ssoAdminServer[105:pool-2-thread-2] [OpId=########-####-####-####-############] [com.vmware.identity.idm.server.provider.BaseLdapProvider] com.vmware.identity.interop.ldap.ServerDownLdapException: Can't contact LDAP server\nLDAP error [code: -1]
YYYY-MM-DDTHH:MMM:SS ERROR ssoAdminServer[105:pool-2-thread-2] [OpId=########-####-####-####-############] [com.vmware.identity.idm.server.IdentityManager] Failed to find person users [Criteria : ] in group [<group>] in tenant [<SSO_Domain>]
YYYY-MM-DDTHH:MMM:SS ERROR ssoAdminServer[105:pool-2-thread-2] [OpId=########-####-####-####-############] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.interop.ldap.ServerDownLdapException: Can't contact LDAP server\nLDAP error [code: -1]'
com.vmware.identity.interop.ldap.ServerDownLdapException: Can't contact LDAP server

• less /var/log/vmware/sso/websso.log : 

YYYY-MM-DDTHH:MMM:SS ERROR websso[80:tomcat-http--34] [CorId=########-####-####-####-############] [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [<ldap://<AD_Server_FQDN>] because [com.vmware.identity.interop.ldap.ServerDownLdapException] with reason [Can't contact LDAP server] therefore will try to attempt to use secondary URIs, if applicable
YYYY-MM-DDTHH:MMM:SS ERROR websso[80:tomcat-http--34] [CorId=########-####-####-####-############] [com.vmware.identity.idm.server.provider.BaseLdapProvider] com.vmware.identity.interop.ldap.ServerDownLdapException: Can't contact LDAP server\nLDAP error [code: -1]
YYYY-MM-DDTHH:MMM:SS ERROR websso[80:tomcat-http--34] [CorId=########-####-####-####-############] [com.vmware.identity.idm.server.IdentityManager] Failed to checkUserAccountFlags principal [<UPN>] for tenant [<SSO_Domain>]
YYYY-MM-DDTHH:MMM:SS INFO websso[80:tomcat-http--34] [CorId=########-####-####-####-############] [com.vmware.identity.diagnostics.VmEventAppender] EventLog: source=[VMware Identity Server], tenant=[<SSO_Domain>], eventid=[USER_NAME_PWD_AUTH_FAILED], level=[ERROR], category=[VMEVENT_CATEGORY_STS], text=[Failed to authenticate principal [<UPN>]. Login failed], detailText=[Login failed], corelationId=[########-####-####-####-############], timestamp=[<time>]
YYYY-MM-DDTHH:MMM:SS ERROR websso[80:tomcat-http--34] [CorId=########-####-####-####-############] [com.vmware.identity.idm.server.IdentityManager] Failed to authenticate principal [<UPN>]. Login failed
javax.security.auth.login.LoginException: Login failed

 

Environment

VMware vCenter Server 8.x

Cause

• The login failures are caused by the VCSA being unable to establish a connection with the configured LDAP server due to port block on firewall.
• Validate the communication between the VCSA and the Domain controller machine using the following command (Port 389 (LDAP), 636 (LDAPS), or 3268/3269 (Global Catalog))  : 

curl -v telnet://<DC_FQDN>:<Port>

Resolution

Restore the connectivity between the VCSA and Domain controller machine.