Error: 'A vCenter Single Sign-On service error occurred' / 'Invalid Credentials' when logging to AD domain accounts

Products

VMware vCenter Server

Issue/Introduction

When navigating to Users and Groups in vCenter with an SSO administrator account, the following error occurs: "A vCenter Single Sign-On service error occurred"

The vmware-identity-sts.log file initially shows that authentication is failing for the service account:

/var/log/vmware/sso/vmware-identity-sts.log:

sts[57:tomcat-http--11]
[corId=####-####-####]
[com.vmware.identity.diagnostics.VmEventAppender]
EventLog:
source=[VMware Identity Server],
tenant=[vsphere.local],
eventid=[USER_NAME_PWD_AUTH_FAILED],
level=[ERROR],
category=[VMEVENT_CATEGORY_STS],
text=[Failed to authenticate principal [svc_@domain]. Login failed],
detailtext=[Login failed],
correlationId=[####-####-####],
timestamp=[####]

ERROR sts[57:tomcat-http--11]
[com.vmware.identity.idm.server.IdentityManager]
Failed to authenticate principal [svc_@domain]. Login failed

The subsequent entries in the same log show that this login is failing due to an untrusted SSL certificate:

ERROR sts[57:tomcat-http--11]
[corId=####-####-####]
[com.vmware.identity.interop.ldap.OpenLdapClientLibrary]
Server SSL certificate not trusted: Subject ()

WARN sts[57:tomcat-http--11]
[corId=####-####-####]
[com.vmware.identity.interop.ldap.LdapErrorChecker]
Error received by LDAP client: com.vmware.identity.interop.ldap.OpenLdapClientLibrary, error code: -1

The vmware-identity-sts.log logs also indicate that a certificate change was detected, but the system failed to retrieve the updated trusted certificates:

YYYY-MM-DDThh:mm:ss INFO sts-default [22 : Thread-9] [CorId= OpId=] [com. vmware. provider. VecsKeyStoreEngine2] [Thread-9] Change in certificates detected. Reloading entries ...
YYYY-MM-DDThh:mm:ss ERROR sts-default [22 : Thread-9] [CorId= OpId=] [com. vmware. identity. util. VcTrustCache] Refresh thread failed to retreive Vctrusts.

Additionally, the ssoAdminServer.log file shows that the LDAP connection fails due to invalid credentials:

/var/log/vmware/sso/ssoAdminServer.log:

ERROR ssoAdminServer[104:pool-2-thread-5] [OpId=########-####-####-####-############] [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldap://domain name.com:389] because [Invalid credentials] therefore will not attempt to use any secondary URIs
ERROR ssoAdminServer[104:pool-2-thread-5] [OpId=########-####-####-####-############] [com.vmware.identity.idm.server.ServerUtils] Exception 'com.vmware.identity.idm.IDMLoginException: Failed to probe provider connectivity [URI: ldap://domain name.com:389 ]; tenantName [vsphere.local], userName [example\user]'
Caused by: com.vmware.identity.interop.ldap.InvalidCredentialsLdapException: Invalid credentials

Environment

vCenter Server

Cause

This issue occurs when the SSL certificate presented by the external LDAP/Active Directory server is not trusted by vCenter (typically due to a recent certificate change on the directory server). This prevents the secure SSL handshake from completing. Because the secure channel cannot be established, the authentication request drops, triggering the "Invalid credentials" errors in the logs.

Resolution

Before making changes, take an offline snapshot (VMs powered off) of the vCenter and all ELM nodes in the same SSO domain. Refer: VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

Retrieve and Save the AD Certificate

Connect to the vCenter Server via SSH and login as root
Run the following command to retrieve the certificate from the domain controller: openssl s_client -connect <domain_controller>:636 -showcerts
Note: Ensure <domain_controller> is replaced with the actual FQDN or IP address of the LDAP server before running the command
Sample Output:
```
-----BEGIN CERTIFICATE-----
MIIFyjCCBLKgAwIBAgIKYURFHAAAAAAA
BDANBgkqhkiG9w0BADSHDFSJnjdwEQYK
..........snip..........
TmqX6mnsaxcjushyuVGYHGVBJKNW5Z5L
hYZhHKsf9CmZa12j/ODfznFtAgbPNw==
-----END CERTIFICATE-----
```
Copy the certificate text from the output, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines, paste it into Notepad, and save the file with a .cer extension.

Replace the Identity Source

Log in to the vSphere Client
Navigate to Administration > Single Sign On > Configuration > Identity Provider > Identity Sources
Select the current Identity Source and click Remove
Click Add to open the Add Identity Source window. Enter the required directory fields, use the Browse button to upload your saved .cer file and save the configuration.

Refer to the following example for standard configuration values.