Intermittent vIDM Authentication Failures Following Active Directory Password Changes

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Users experience intermittent authentication failures when attempting to log in to the VMware Aria Operations cluster via VMware Identity Manager (vIDM) 3.3.7.

The following symptoms are observed:

• Affected users receive the explicit error message: Your username or password is incorrect.
• The authentication failure typically triggers immediately after a user updates their password within Active Directory (AD).

Environment

VMware Identity Manager 3.3.7

Cause

This issue occurs due to a mismatch between the user identity attributes stored in vIDM and those passed by Active Directory during authentication.

When user identifier formats (such as sAMAccountName or userPrincipalName) are altered or inconsistent within Active Directory, it creates a conflict with the historical user profile records existing in vIDM. Because the incoming authentication tokens do not match the synchronized database records, the OAuth/SAML token evaluation fails, rejecting the login attempt.

Resolution

This is an Active Directory configuration issue caused by inconsistent user naming formats across user accounts. To resolve this issue, ensure a uniform user naming policy is applied in Active Directory to align mismatched attributes, followed by a directory synchronization in vIDM to update the user profiles.