AES encryption configuration for Active Directory communication - VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

VCSA authentication fails when Microsoft domain-level enforcement of AES encryption is active and RC4 protocols are deprecated. This occurs because Integrated Windows Authentication (IWA) identity sources natively utilize RC4 encryption.

Symptoms:

• Domain controllers reject authentication requests originating from the vCenter Server.

• Domain Controller system logs show Event ID 5840 indicating RC4-encrypted secure channel attempts.

• Authentication failure for all service accounts and users utilizing the Active Directory Integrated Windows Authentication (IWA) Identity Source.

Environment

• VMware vCenter Server 7.x

• VMware vCenter Server 8.x

Cause

Identity sources configured using 'Integrated Windows Authentication' strictly utilize RC4 encryption. Microsoft domain-level deprecation of RC4 invalidates this configuration, leading to authentication drops.

Resolution

To ensure compatibility with AES encryption, migrate the VCSA Single Sign-On Identity Source from IWA to Active Directory over LDAPS.

1. Navigate to the vCenter Single Sign-On configuration and delete the existing Integrated Windows Authentication (IWA) identity source.

2. Add a new Identity Source using the Active Directory over LDAP type.

3. Utilize Global Catalog port 3269 (LDAPS) to allow the vCenter Server to query the entire domain forest.

4. Configure the Base DN at the forest root (e.g., DC=domain,DC=com).

5. Assign vCenter permissions utilizing Active Directory Universal Groups to maintain multi-domain access.

6. In Active Directory, locate the vCenter computer object and set the msDS-SupportedEncryptionTypes attribute to 24 (AES128 + AES256).

7. Populate the Domain Alias field in the vCenter configuration to maintain NetBIOS\username login formatting.

Fixed in vSphere 8.0 Update 3 and higher. See Download Broadcom products and software for steps to download this release.

Additional Information

• Integrated Windows Authentication is deprecated and scheduled for removal in the major release following vSphere 8.0 Update 3, as stated in the release notes.

• References:

  • Removal of Integrated Windows Authentication (IWA) (KB 314324)

  • Configure an AD over LDAP Identity Source (KB 316596)

  • Considerations when migrating identity source from IWA to AD over LDAP (KB 344919)

• Subscribe to this article to receive updates on fix status: How to subscribe to Knowledge Base articles