"LDAP Error Code 49"/Error (49) error in vmdird logs in vCenter Server for the [e-mail] account

Products

• VMware vCenter Server

Issue/Introduction

The following errors are observed in the VMware Directory Service logs (/var/log/vmware/vmdird/vmdird-syslog.log):

• err vmdird: SASLSessionStep: sasl error (-13)(SASL(-13): authentication failure: client evidence does not match what we calculated. Probably a password error)
• err vmdird: VmDirSendLdapResult: Request (Bind), Error (49), Message ((49)(SASL step failed.))
• err vmdird: Bind Request Failed error 49: Protocol version: 3, Bind DN: "cn=####,ou=Domain Controllers,dc=vsphere,dc=local", Method: SASL
• ERROR: VdirPasswordFailEvent from user(cn=administrator,cn=users,dc=vsphere,dc=local)

Environment

VMware vCenter Server 8.x

Cause

This issue occurs when there is a password mismatch between a client and the VMware Directory Service (vmdird). Common trigger:

• Stale Credentials: A second or third-party system (e.g., backup or monitoring server) is using an outdated [e-mail] password.

Resolution

The offending party can be found in the journalctl log located in /commands.  The timestamp of the vmdird-syslog.log entry can be aligned to an entry in the journalctl log to find the offending party.

[vim.event.BadUsernameSessionEvent] [error] [[e-mail]] [] [#######] [Cannot login [e-mail]@##.##.##.##]

Update the stored credentials on that external system to match the current [e-mail] password.

Additional Information

If you need additional assistance Contact Support