vCenter domain authentication requests fail due to host-based time setting

Products

• VMware vCenter Server

Issue/Introduction

When trying to login to vCenter with a domain account (LDAP, Active Directory, etc), an error message is thrown, blocking the login from proceeding:

An error occurred while fetching identity providers. Please try again later. If problem persists, contact your administrator.

When trying with the [email protected] account, or any other local user account, the login attempt succeeds.

Cause

The vCenter Server is configured to use "Host" for time settings, but some of the hosts do not have valid time settings. This can happen when adding new hosts to a vCenter environment, and the hosts have not had their time settings considered.

Check the time settings vCenter Server is configured for by logging in to https://<vCenterFQDN/IP>:5480 as the root user. Select Time, and under Time Synchronization click Edit.

If the setting is "Host" then it means the vCenter is configured to get it's time from the hosts it manages.

Resolution

Find the time settings that the domain controllers or otherwise identity source uses. In some cases, the domain controllers or identity sources themselves may host NTP, in which case you can set the vCenter to use the IP/FQDN of the identity source itself.

Reconfigure the vCenter to use NTP, and not Host. Refer to Configure Network Time Protocol (NTP) on the Vcenter.