Users are immediately logged out or experience persistent authentication drops in VMware Identity Manager (vIDM)

Products

• VCF Operations

Issue/Introduction

When attempting to access the VMware Identity Manager (vIDM) user portal or administration interface, you experience the following behavior:

• Users are able to successfully authenticate on the main login screen, but are immediately redirected back to the login page upon clicking any internal menu item (such as Catalog, Dashboard, or Preferences).

• Active user sessions fail to persist, resulting in a continuous, infinite login loop during basic page navigation.

• The issue occurs across all web browser sessions and persists when bypassing external Load Balancers to connect directly to individual cluster nodes.

Environment

vIDM 3.3.7

Cause

This issue occurs when the Re-authenticate After parameter within the default_access_policy_set for Web Browser access is misconfigured or explicitly set to 0.

The Re-authenticate After setting dictates the maximum duration (in hours or minutes) a user session remains valid before requiring a fresh authentication challenge. When this token lifetime parameter is set to 0, the system evaluates the session as having an instantaneous expiration window.

While the initial login workflow successfully validates the user credentials and grants entry to the landing screen, any subsequent navigation choice fires a mandatory security policy evaluation check. Because the re-authentication window is effectively non-existent (0), the framework determines that the session has expired and instantly revokes the access token, triggering an immediate logout redirection.

Resolution

To resolve this issue, the Re-authenticate After parameter must be adjusted to a standard operational session window within the access policy configuration.

Modify the Access Policy Rule

1. From the administration dashboard, navigate to Identity & Access Management > Policies.

2. Locate the default_access_policy_set and click Edit.

3. Scroll down to the policy rules section and locate the specific policy rule assigned to the Web Browser device type.

4. Locate the configuration option labeled Re-authenticate After.

5. Change the value from 0 to an appropriate organizational session lifespan baseline (e.g., 8 hours).

6. Save the modified rule configuration, then click Save on the overall policy set to push and sync the change across the deployment.