vCenter UI Logins Fail With Empty SSO Response String Due to DNS latency or unreachability
search cancel

vCenter UI Logins Fail With Empty SSO Response String Due to DNS latency or unreachability

book

Article ID: 444440

calendar_today

Updated On:

Products

VMware vCenter Server 8.0

Issue/Introduction

The primary product affected is VMware vCenter Server, specifically within the Single Sign-On (SSO) and Security Token Service (STS) components.

You may observe the following symptoms:

  • The vSphere Client UI hangs on a continuous loading screen after you enter credentials.
  • vCenter Server UI logins (both local and Active Directory) fail with the following error message: [500] An error occurred while processing the authentication response from the vCenter Single Sign on server. Details: Empty SSO response string.

  • Login attempts for local accounts (e.g., administrator@vsphere.local) fail or time out despite valid credentials.

  • The var/log/vmware/sso/vmware-identity-sts-perf.log indicates severe latency establishing LDAP connections: 

    • 2026-05-02T04:54:31.732Z INFO sts-perf[87:tomcat-http--49] [CorId=d9512fe1-94dc-4c8c-8311-f3b692804086] [com.vmware.identity.performanceSupport.PerfDataSink] PerfBucketKey [measurementPt=LdapBindConnection, providerInfo=LDAP://######:389], ms=15251 2026-05-02T04:54:31.732Z INFO sts-perf[87:tomcat-http--49] [CorId=d9512fe1-94dc-4c8c-8311-f3b692804086] [com.vmware.identity.performanceSupport.PerfDataSink] PerfBucketKey [measurementPt=IDMAuthenticate, providerInfo=#######], ms=15254

  • The \var\log\vmware\sso\tomcat\catalina.log displays Tomcat stuck thread detection abort messages with threads stuck in ldap_bind_s:

    • 2026-05-02T03:59:55.279Z WARN org.apache.catalina.valves.StuckThreadDetectionValve Thread [tomcat-http--153] (id=[205]) has been interrupted because it was active for [2,082,948] milliseconds (since [5/2/26 3:25 AM]) to serve the same request for [http://localhost/sts/STSService/#####] and was probably stuck (configured interruption threshold for this StuckThreadDetectionValve is [600] seconds).

      at com.vmware.identity.interop.ldap.$Proxy32.ldap_bind_s(Unknown Source) at com.vmware.identity.interop.ldap.OpenLdapClientLibrary.ldap_bind_s(OpenLdapClientLibrary.java:748) at com.vmware.identity.interop.ldap.LdapConnection.bindConnection(LdapConnection.java:130)

Environment

VMware vCenter Server 8.0

Cause

Secure Token Service (STS) HTTP request thread exhaustion occurs when Tomcat worker threads become stuck in ldap_bind_s system calls due to excessive network or DNS latency or unreachability while attempting to connect to the remote Active Directory LDAP server.

 

Resolution

Resolution: 

Maintain the health and connectivity of the external Active Directory and DNS environment. Implement continuous monitoring of the AD and DNS infrastructure for performance bottlenecks and network latency to prevent future thread exhaustion.

Temporary Workaround:

To restore access to your vCenter Server:

1. Take a snapshot of the vCenter Server Appliance.

2. Access the vCenter Shell via SSH or VM Console.

3. Identify the unreachable Identity Source by testing DNS resolution:

nslookup <LDAP_FQDN>

4. Implement a temporary bypass by adding the LDAP server to the local hosts file. 

5. Clear the thread backlog by restarting the Security Token Service:

service-control --restart vmware-stsd

 

Powered by Wolken Software