VCD LDAP integration service account experiencing repeated AD lockouts

Products

• VMware Cloud Director

Issue/Introduction

• An Active Directory service account used for SSO/LDAP authentication (e.g. Username) is experiencing continuous lockouts.

• Active Directory logs show ongoing authentication requests for this specific username coming from VMware Cloud Director (VCD) cell nodes.

• Switching the SSO configuration to a another account (e.g. Username-bk) restores user logins, but the rogue authentication traffic for the original account continues.

Environment

VMware Cloud Director 10.6.1

Cause

The issue is driven by two factors:

1. Tenant-Level Misconfiguration: One or more VCD tenants may still be configured to use the legacy service account for their specific LDAP synchronization, independent of the system-level provider.
2. Database Redundancy: Stale entries for the legacy account remain in the ldap_provider table of the VCD database. This causes the internal identity manager to continue polling AD using the old credentials for background tasks.

Resolution

To resolve the lockouts, you must update the tenant-level configuration, clean up the stale database records, and flush the service cache.

Prerequisites

• Take a backup of the VMware Cloud Director database
• Identify the specific tenants still utilizing the legacy credentials

Procedure

Update Tenant Configuration:

• Log in to the VCD Provider portal.
• Navigate to Organizations and select the affected tenant(s).
• Under Administration > Identity Providers > LDAP, ensure the legacy user is removed and replaced with the current service account.

Identify and Remove Stale Database Entries:

• Access the VCD database (PostgreSQL).
• Identify the stale provider entries by running:
   

  SELECT username, paged_search_disabled, page_size, max_results FROM ldap_provider;

• If duplicate rows exist for the same AD hostname, identify the id of the legacy account and remove it:
   

  DELETE FROM ldap_provider WHERE username = 'username';

  Here username is the account used to integrate LDAP with VCD.

Flush Identity Cache:

• Restart the vmware-vcd service on all cell nodes to force a reload of the identity configuration:
   

  service vmware-vcd restart

Verification:

• Monitor Active Directory logs to confirm that authentication requests for the legacy account have ceased.
• Audit external integrations (e.g., Aria Operations) to ensure no external agents are using cached credentials.