Permission errors occur in vCenter Server after switching Identity Source from IWA to AD over LDAP

Products

• VMware vCenter Server

Issue/Introduction

• After migrating the identity source from Integrated Windows Authentication (IWA) to Active Directory over LDAP, permissions configured at the inventory level stop working, resulting in permission errors.
  
  
• This occurs if the NetBIOS name was not entered in the Domain alias field during the Active Directory over LDAP configuration.
  
  
• Because vpxd maintains a normalization cache for domain names, this issue typically manifests after a vpxd service restart following the migration to AD over LDAP.

Environment

vCenter Server 8.x

Cause

IWA Authentication: Permissions are saved using a principal name format that utilizes the NetBIOS name:
<NetBIOS name>\<username or group name> (e.g., TEST\Administrator).

Active Directory over LDAP (Without Alias): If the domain alias is not set, the uppercase full domain name is used instead:
<UPPERCASE DOMAIN NAME>\<username or group name> (e.g., TEST.LOCAL\Administrator).

Because of this mismatch between the saved principal name and the newly evaluated format, permission authentication fails.

Resolution

To resolve this issue, reconfigure the identity source and explicitly specify the NetBIOS name in the Domain alias field.

1. In the vSphere Client, click the top-left menu icon and select Administration.
2. Navigate to Single Sign On > Configuration.
3. Select the current Identity Source and click REMOVE.
4. Click ADD, then configure Active Directory over LDAP, ensuring you fill in the Domain alias field with your NetBIOS name.
   
   

Additional Information

Removal of Integrated Windows Authentication (IWA)
https://knowledge.broadcom.com/external/article/314324

Considerations when migrating a vCenter Identity Source from Integrated Windows Authentication to AD over LDAP / OpenLDAP
https://knowledge.broadcom.com/external/article/344919