VCF Operations - VIDB - AD Users Show Status Inactive and Fail Login Due to Attribute Mappings Error

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

All or most users synced from an Active Directory identity source display as Inactive or Disabled in VCF Operations → Identity & Access → Access Management. The issue affects all users regardless of their actual AD account state (userAccountControl = 0x200). Manual AD syncs complete without errors but do not change the user status.

Login attempts to VCF components fail with the message: Access Denied — Unable to authenticate the user

The VIDB Test Login flow completes successfully but displays the following authorization warning: USER_IS_DISABLED — The user account has not been provisioned yet

VIDB synchronization logs display repeated exceptions from UserConvertor.toUser() during sync cycles: javax.naming.InvalidNameException: Invalid name: <sAMAccountName>

 

Environment

VMware Cloud Foundation 9.x (confirmed on 9.1)

VIDB identity source configured with Active Directory over LDAP

Embedded IDP authentication mode

Cause

The VIDB identity source Attribute Mappings are misconfigured, specifically mapping the active and distinguishedName fields to sAMAccountName.

Because sAMAccountName returns a string value, VIDB cannot evaluate it as a boolean and defaults to treating every synced user as inactive/disabled on every sync cycle.

Furthermore, VIDB receives a plain username string where it expects a full LDAP Distinguished Name, causing the InvalidNameException parse failures.

Resolution

1. In VCF Operations, navigate to Identity & Access → VCF SSO Overview → [SSO Domain] → Identity Source.
2. Select the affected Active Directory and navigate to Attribute Mappings → Edit.
3. Verify the mappings and correct any that point to sAMAccountName incorrectly. Apply the following correct AD attributes: active: isActive (or the appropriate boolean attribute per your AD)
   
   distinguishedName: distinguishedName
firstName: givenName
lastName: sn
email: mail
userName: sAMAccountName
userPrincipalName: userPrincipalName


4. Save the changes and trigger a manual sync.
5. Verify users now display as Active in the Access Management tab.

Additional Information

The VIDB Test Login result showing USER_IS_DISABLED after successful AD authentication is a reliable indicator of this specific misconfiguration, confirming authentication succeeds but VIDB's internal user status blocks provisioning.

The InvalidNameException errors in VIDB sync logs are a secondary indicator specifically pointing to the distinguishedName mapping failure.

VMware Cloud Foundation 9.1 Identity and Access Management