Global Search is slow for Active Directory users in vCenter Server Enhanced Linked Mode

Products

• VMware vCenter Server

Issue/Introduction

• You experience a latency of approximately 60 seconds per query when using the Global Search functionality in the vSphere Client.
• This delay occurs specifically when you are logged in as an Active Directory authenticated user.
• Search results are eventually returned after the timeout period.
• The issue does not occur when you use the local [email protected] account.
• In the /var/log/vmware/vsphere-ui/logs/dataservice.log, you see warning messages indicating a 60-second timeout:

[<DATE_TIME_###########################>] [WARN ] serenity-thread-pool-578     DataServiceThreadPoolDecorator$1 [queryId: q-13291:QuickSearch:1025008341:01:library01] Data Service execution for task: io.opentelemetry.context.Context$$Lambda$664/583652280@3b00d81 has failed after 59803 ms com.vmware.vcenter.apigw.security.AuthenticationException: Failed to log into [uri=http://localhost:1080/external-vecs/http2/<VCENTER_DETAILS_#######################>/443/cls/, sessionMgr=SessionManagerInfo [_sessionMgrSvcId=com.vmware.cis.session, _loginOpId=create, _logoutOpId=delete], ssoDomain=vsphere.local(<SSO_DOMAIN_ID_####################################>)]: com.vmware.vapi.std.errors.internal_server_error => {data=<unset>, error_type=INTERNAL_SERVER_ERROR, messages=[com.vmware.vapi.std.localizable_message => {args=[Failed trying to retrieve token: ns0:RequestFailed: Cannot established a connection to server :: Can't contact LDAP server], default_message=Provider method implementation threw unexpected exception: Failed trying to retrieve token: ns0:RequestFailed: Cannot established a connection to server :: Can't contact LDAP server, localized=<unset>, id=vapi.bindings.method.impl.unexpected, params=<unset>}]}

 

Caused by: com.vmware.vcenter.apigw.security.AuthenticationException: Failed to log into [uri=http://localhost:1080/external-vecs/http2/<VCENTER_DETAILS_#######################>/443/cls/, sessionMgr=SessionManagerInfo [_sessionMgrSvcId=com.vmware.cis.session, _loginOpId=create, _logoutOpId=delete], ssoDomain=vsphere.local(<SSO_DOMAIN_ID_####################################>)]: com.vmware.vapi.std.errors.internal_server_error => {data=<unset>, error_type=INTERNAL_SERVER_ERROR, messages=[com.vmware.vapi.std.localizable_message => {args=[Failed trying to retrieve token: ns0:RequestFailed: Cannot established a connection to server :: Can't contact LDAP server], default_message=Provider method implementation threw unexpected exception: Failed trying to retrieve token: ns0:RequestFailed: Cannot established a connection to server :: Can't contact LDAP server, localized=<unset>, id=vapi.bindings.method.impl.unexpected, params=<unset>}]}

 

[<DATE_TIME_###########################>] [WARN ] p-nio-127.0.0.1-5090-exec-99 <USER_DETAILS_####################> ProfilingLogService [queryId: q-13291:QuickSearch:1025008341] The Data Service detected slow execution:
 
The query batch execution took too long: 59810 milliseconds.
 
A DataProviderAdapter ([Adapter: com.vmware.vise.data.adapters.core.DataServiceCoreAdapter@6b5de6ff,  typeInfo: null]) execution took too long: 59810 milliseconds.

 

 

Environment

vCenter in Enhanced Linked Mode environment(ELM) 

 

Cause

This issue occurs due to a federated search timeout within a vCenter Enhanced Linked Mode (ELM) environment.

When you perform a global search, the primary vCenter passes your Active Directory session token to the linked vCenter Server (e.g., ####-vc02) to retrieve its inventory.

If the secondary vCenter Server is unable to establish a connection to the configured LDAP server to validate the passed token due to network constraints, firewall blocks, or site-specific routing the query hangs for 60 seconds. Once the timeout is reached, the primary vCenter defaults to returning only local inventory results.

Resolution

To resolve this issue, you must ensure that all vCenter Servers in the Enhanced Linked Mode environment have successful LDAP connectivity to validate Active Directory session tokens.

1. Log in to the vSphere Client.
2. Navigate to Administration > Single Sign-On > Configuration.
3. Under the Identity Provider tab, select the Active Directory identity source.
4. Modify the configuration to add a reachable, local Domain Controller as a secondary LDAP server for the vCenter appliance at the remote site.
5. Alternatively, ensure that firewall rules allow LDAP/LDAPS traffic (typically ports 389 or 636) from the secondary vCenter appliance to the Active Directory Domain Controllers.

Once the secondary vCenter can validate the session token, federated search results return instantly.

Additional Information

For more information on configuring identity sources, see Add or Edit a vCenter Single Sign-On Identity Source.