Error: "Service accounts cannot login to vCenter" after vCenter upgrade to version 8.0 Update 3h

Products

• VMware vSphere ESXi

Issue/Introduction

• After updating vCenter to 8.0 U3h build 25092719 service accounts and other non-interactive logins fail.  
• Service accounts cannot login to the vCenter after vCenter upgrade to version 8.0 Update 3h
  • Example: Products that use service accounts for non-interactive logins, such as backup solution (Rubrik, Veeam, etc), disaster recovery solution, provisioning solution, scripts, etc.
• There is 2FA in ADFS or AD enabled in the environment 
• After upgrading to vCenter 8.0.3.00700 (8.0 U3h build 25092719), vCenter GUI logins for AD user accounts (via ADFS redirect) still succeed, but AD service account logins (via vCenter APIs) are no longer successful after upgrade.

Environment

VMware vCenter server 8.0.3 00700 (8.0 U3h build 25092719)

Cause

Previously, service accounts with MFA enabled were able to access vCenters without any MFA input if the vCenter had both a federation provider and a legacy provider servicing the same domain. This vulnerability has been patched out of vCenter as of 8.0 u3h, so failure is an expected behavior. MFA is now fully enforced on all accounts, service accounts included. 

Resolution

• If in vCenter 8.0 Update 3h reconfigure the two-factor authentication 2FA / MFA policies in ADFS or AD so that the service accounts are not subjected to 2FA. Currently, 2FA is being enforced on the ADFS or AD side, which is why the service accounts cannot login.
• If version is before vCenter 8.0 Update 3h, delete the legacy provider servicing the same domain by using the command line sso-config utility to stop user and group enumeration by API, such as PowerCLI Get-VIAccount.

 

Additional Information

• Read more at Security Issues
• Contact Broadcom support