Error: Invalid credentials during Active Directory login to vCenter Server when RC4 is disabled

Products

• VMware vCenter Server

Issue/Introduction

Authentication fails between vCenter Server and Active Directory when domain-level enforcement of AES encryption is active and RC4 protocols are deprecated. This issue commonly occurs in environments implementing Active Directory Hardening GPOs. 

Symptoms:

• Logging into vCenter Server with Active Directory credentials fails with error message: Invalid credentials.

• Domain Controller system logs show Event ID 5840 indicating RC4-encrypted secure channel attempts.

• Authentication fails for all service accounts and users utilizing the Active Directory Integrated Windows Authentication (IWA) Identity Source.

Environment

• VMware vCenter Server 7.x

• VMware vCenter Server 8.x

Cause

Identity sources configured using Integrated Windows Authentication strictly utilize RC4 encryption. Microsoft domain-level deprecation of RC4 invalidates this configuration, leading to authentication drops.

Resolution

To ensure compatibility with AES encryption, migrate the vCenter Server single sign-on identity source from IWA to Active Directory over LDAPS.

1. Remove the existing IWA identity source:

   1. Log in to vCenter Server using the vSphere Client.

   2. Navigate to Menu > Administration > Configuration.

   3. Under the Identity Provider tab, click on Identity Sources.

   4. Select the Identity source with type Active Directory (Integrated Windows Authentication).

   5. Click Remove.

2. Configure Identity source as LDAPS. Refer to: Single Sign-On Identity Source configuration using LDAPS in vSphere Client

   1. Utilize Global Catalog port 3269 (LDAPS) to allow the vCenter Server to query the entire domain forest.

   2. Configure the Base DN at the forest root (e.g., DC=domain,DC=com).

   3. Assign vCenter Server permissions utilizing Active Directory universal groups to maintain multi-domain access.

   4. In Active Directory, locate the vCenter Server computer object and set the msDS-SupportedEncryptionTypes attribute to 24 (AES128 + AES256).

   5. Populate the domain alias field in the vCenter Server configuration to maintain NetBIOS\username login formatting.

Additional Information

• Integrated Windows Authentication is deprecated and scheduled for removal in the major release following vSphere 8.0 Update 3, as stated in the release notes.

• References:

  • Removal of Integrated Windows Authentication (IWA) (KB 314324)

  • Configure an AD over LDAP Identity Source (KB 316596)

  • Considerations when migrating identity source from IWA to AD over LDAP (KB 344919)