Active Directory Logins Fail in VCF Automation 9.0.2 despite successful directory Synchronization

Products

• VCF Operations
• VCF Automation

Issue/Introduction

During a VMware Cloud Foundation (VCF) 9 deployment, administrators may observe that while Active Directory (AD) directory synchronization completes successfully, actual user logins fail.

Symptoms of this issue include:

• The domain fails to auto-populate on the Single Sign-On (SSO) login screen.

• Attempts to reset or reconfigure the SSO settings do not resolve the authentication rejections.

• System logs capture a specific failure during the login attempt indicating the user cannot be found, such as:

  Found (0) user(s) having the (<username>) attribute under base distinguished name () - FAILURE.

Environment

VCF Automation 9.0.2

 

Cause

The root cause is a configuration mismatch between the Global Catalog (GC) search scope and the Active Directory topology. This is working as intended

Two compounding issues cause the authentication to fail:

1. Duplicate Accounts in the Forest: The Active Directory environment contains accounts with the exact same username (sAMAccountName) spread across different domains (e.g., one in the root domain and one in a child domain). VIDB enforces a strict security policy requiring that a login username maps to exactly one unique account.

2. Forced Empty BaseDN in Global Catalog: When configured as a Global Catalog identity source, VIDB forces an empty Base Distinguished Name ("") during login searches to query the entire AD forest.

The Discrepancy:

• During Sync: The system uses the configured, scoped BaseDN and searches by distinguishedName, successfully finding and syncing the specific user.

• During Login: The system is forced to use an empty BaseDN ("") and searches by sAMAccountName. Because it searches the entire forest, it discovers the duplicate accounts (violating the uniqueness policy) or hits Global Catalog indexing limitations, resulting in the system rejecting the login and reporting 0 valid users found.

Resolution

To resolve the login issue and satisfy the strict uniqueness requirements of the VCF 9 architecture, the identity source configuration must be adjusted to restrict searches to a specific domain.

1. Switch Identity Source Type Modify the identity source configuration from a Global Catalog (GC) connection to a standard Active Directory (AD) connection (typically moving from port 3268 to port 389/636).

2. Enforce a Domain-Specific BaseDN By applying the standard AD configuration, you can enforce a strict BaseDN. Set the BaseDN to target the specific domain where the target users reside (e.g., DC=child,DC=company,DC=com).

Solution Justification: By scoping directory searches to a specific domain via a defined BaseDN, the search is restricted to a single domain rather than querying the entire forest. This prevents the system from encountering duplicate root/child accounts and bypasses the Global Catalog empty-base limitations. Manual LDAP testing confirms that while a forest-wide query returns multiple users (triggering the failure), a query scoped with a specific BaseDN returns exactly one unique identity, thereby completely resolving the authentication outage.