Azure Entra ID service accounts intermittently fail to log into vCenter

Products

• VMware vSphere ESXi

Issue/Introduction

- Service accounts configured in Azure Entra ID intermittently fail to log into the vCenter, for example 1 in every 5 login attempts for the same user during a short period of time may fail.

- In /var/log/vmware/sso/vmware-identity-sts.log on the vCenter, the following errors are observed:

[com.vmware.identity.idm.server.IdentityManager] Failed to authenticate principal

- During the same time period, the same user has successful log in attempts in the same log location as above:

Token xxxx-xxxx-xxxx-xxxx for principal {Name: Name, Domain: domain.com} successfully validated.

Environment

vCenter 8.0 U3

Azure Entra ID

Cause

This issue occurs because of a TCP race condition.

These failures can occur when a high volume of login requests for the same user is sent in a very short interval. This high-frequency activity forces the system to reuse pooled connections. When the connection sits idle for a brief period, the next rapid burst of requests can attempt to use a connection that was just closed, leading to the Connection was closed error.

Resolution

This will be fixed in the next patch release of 8.0 U3.