PowerCLI cmdlet error - vSphere single sign-on failed for connection error - Intermittent Active Directory connectivity in vCenter

Products

• VMware vCenter Server

Issue/Introduction

You may observe a similar error when querying vCenter via PowerCLI

Get-TagAssignment -Entity (Get-VM -Name "VM")

vSphere single sign-on failed for connection 'https://<domain>/sts/STSService/vsphere.local'. Future operations which require single sign-on on this connection will fail. The underlying cause was: IDM threw unexpected error during authentication :: Native platform error [code: 40071][LW_ERROR_NO_SUCH_OBJECT][No such user, group or domain object] :: Native platform error [code: 40071][LW_ERROR_NO_SUCH_OBJECT][No such user, group or domain object]

 

likewise.log

INFO lsass: [0x7fb55cb99640] Clearing ldap DC connection list for domain 'DOMAIN.NAME' due to a network error.

 

Environment

vCenter 8.x

Cause

These messages occur when the Likewise service (lsassd) loses communication with one or more LDAP domain controllers and clears its internal connection list.

Common causes include:

• Intermittent network connectivity between vCenter/ESXi and the AD domain controllers

• DNS resolution failures or incorrect DNS configuration

• Firewall or routing drops on LDAP/LDAPS ports (389, 636, 3268)

• Domain controller unavailability (restarts, maintenance, or replication latency)

• Clock drift causing Kerberos ticket validation to fail - https://knowledge.broadcom.com/external/article?articleNumber=373032

Resolution

Verify network connectivity between vCenter & AD server
nc -zv <dc_fqdn> 389
nc -zv <dc_fqdn> 636
nc -zv <dc_fqdn> 3268

Fix clock skew - NTP synchronization
correct the time for the vCenter appliance by configuring an NTP server or setting the time manually, or by setting the time or correcting the NTP settings on the ESXi host that the VCSA is running on if it's set to synchronize time with the host.

Check DNS Resolution
nslookup <dcname>
nslookup <ip_of_dc>