The NSX LDAP service account is repeatedly getting locked out
search cancel

The NSX LDAP service account is repeatedly getting locked out

book

Article ID: 447047

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • Unable to login using service account as the specified account is locked.

  • LDAP Server connection status reports as 'Down'.
  • Unable to create a new users while the service account is lockout.

Environment

VMware NSX

Cause

1. From NSX manager, we checked /var/log/proxy/reverse-proxy.log and we notice below error where authentication is failing due auth methods failed.

74298:2026-06-03T06:03:16.749Z  INFO grpc-default-executor-3786 AuthService 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Forwarding 83 bytes of application/x-www-form-urlencoded
74299:2026-06-03T06:03:16.749Z  INFO grpc-default-executor-3786 HttpClientUtil 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Making request to http://127.0.0.1:#####/j_spring_security_check
74300:2026-06-03T06:03:16.755Z  INFO Processing request #######-####-####-####-####### PAMAuthenticationProvider 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Local auth for <Username> unsuccessful, trying other auth methods.
74301:2026-06-03T06:03:16.755Z  INFO Processing request #######-####-####-####-####### DelegatingLdapAuthProvider 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Could not retrieve domain name from user name ####### . Authentication will not be tried over LDAP
74302:2026-06-03T06:03:16.756Z  INFO Processing request #######-####-####-####-####### PasswordExpirationFailureHandler 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Exception is not PasswordExpiredException
74303:2026-06-03T06:03:16.756Z  INFO grpc-default-executor-3786 HttpClientUtil 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Request executed, response = HttpResponseProxy{HTTP/1.1 200  [Set-Cookie: JSESSIONID=########; Path=/; Secure; HttpOnly; SameSite=Lax, Cache-Control: no-cache, no-store, max-age=0, must-revalidate, Pragma: no-cache, Expires: 0, X-XSS-Protection: 1; mode=block, X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Content-Length: 0, Date: Wed, 03 Jun 2026 06:03:16 GMT, Keep-Alive: timeout=60, Connection: keep-alive] [Content-Length: 0,Chunked: false]}
74304:2026-06-03T06:03:16.790Z  INFO grpc-default-executor-3786 HttpClientUtil 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Making request to http://127.0.0.1:####/login.jsp?login_error=1
74305:2026-06-03T06:03:16.791Z  INFO Processing request #######-####-####-####-####### BaseProxyDelegate 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Processing request to /login.jsp (login_error=1) with /login.jsp -> 127.0.0.1:####:/login.jsp

2. From  tail -f localhost_access.log during login failure.

2026-06-03T06:03:16.756Z 127.0.0.1 - "POST /j_spring_security_check HTTP/1.1" 200 - 6 6
2026-06-03T06:03:16.791Z 127.0.0.1 - "GET /login.jsp?login_error=1 HTTP/1.1" 200 - 1 1          -----------------------------------> Login error at 2026-06-03T06:03:16
2026-06-03T06:03:16.842Z 127.0.0.1 - "GET /login.jsp?login_error=1 HTTP/1.1" 200 21763 50 50

3. For another incident we notice below error where account is locked in /var/log/proxy/reverse-proxy.log

2026-06-03T06:24:48.504Z  INFO grpc-default-executor-3806 HttpClientUtil 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Making request to http://127.0.0.1:####/j_spring_security_check
2026-06-03T06:24:48.545Z  INFO Processing request #######-####-####-####-####### NsxTrustManager 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Trust allow-listed server certificate for CN=####-##
2026-06-03T06:24:48.545Z  INFO Processing request #######-####-####-####-####### NsxTrustManager 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] checkServerTrusted: CN=####-## for authType=ECDHE_RSA succeeded.
2026-06-03T06:24:48.586Z  INFO Processing request #######-####-####-####-####### CustomActiveDirectoryLdapAuthenticationProvider 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Active Directory authentication failed: Account locked
2026-06-03T06:24:48.586Z  WARN Processing request #######-####-####-####-####### CustomOidcAuthorizationCodeAuthenticationProvider 74334 - [nsx@6876 comp="nsx-manager" level="WARNING" subcomp="http"] password grant flow authentication failed
2026-06-03T06:24:48.587Z  INFO Processing request #######-####-####-####-####### PasswordExpirationFailureHandler 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Exception is not PasswordExpiredException
2026-06-03T06:24:48.588Z  INFO grpc-default-executor-3806 HttpClientUtil 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Request executed, response = HttpResponseProxy{HTTP/1.1 200  [Set-Cookie: JSESSIONID=######; Path=/; Secure; HttpOnly; SameSite=Lax, Cache-Control: no-cache, no-store, max-age=0, must-revalidate, Pragma: no-cache, Expires: 0, X-XSS-Protection: 1; mode=block, X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Content-Length: 0, Date: Wed, 03 Jun 2026 06:24:48 GMT, Keep-Alive: timeout=60, Connection: keep-alive] [Content-Length: 0,Chunked: false]}
2026-06-03T06:24:48.624Z  INFO grpc-default-executor-3806 HttpClientUtil 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Making request to http://127.0.0.1:####/login.jsp?login_error=1
2026-06-03T06:24:48.624Z  INFO Processing request #######-####-####-####-####### BaseProxyDelegate 74334 - [nsx@6876 comp="nsx-manager" level="INFO" subcomp="http"] Processing request to /login.jsp (login_error=1) with /login.jsp -> 127.0.0.1:####:/login.jsp

4. Similarly, we can find the operation failure in /var/log/syslog

2026-06-03T06:23:21.280Z ######-### NSX 74334 SYSTEM [nsx@6876 audit="true" comp="nsx-manager" level="INFO" subcomp="http"] UserName="#####@##.##, ModuleName="ACCESS_CONTROL", Operation="LOGIN", Operation status="failure"

 

Resolution

This is a condition that may occur in a VMware NSX environment.

Pre-requisites : Validate connectivity between LDAP and NSX manager.

  • Check the ldap connectivity via PING and netcat
    nc -zvv <LDAP-server-IP> <port-number-used-for-LDAP>

    Example:
    nc -zvv <LDAP-server-IP> 389 (for LDAP)
    nc -zvv <LDAP-server-IP> 636 (for LDAPS)
    nc -zvv <LDAP-server-IP> 3268 (for LDAP GC)
    nc -zvv <LDAP-server-IP> 3269 (for LDAPS GC)
  • Check the lockout period 
    get auth-server status

1. Check for configured AD servers for the reported locked account. Eg: Both LDAP & IDFW event log scrapper could be configured

2. Check if password was recently updated/changed.

3. Check for events from AD server locking the account. This shall provide information on IPs, event IDs and caller computers etc.

eg: 

  • Timestamp - Event ID - Event - Account Caller Computer - Domain Controller
  • Fri Jun 19 11:29:34 AEST 2026 - 4740 - Account Locked Out - xxxxxxxxx - jcifs1_1_3b - xxxxx-xxx

4. You can try the following if IDFW event log scrapper is configured :

1. Fix IDFW event log server configuration (fixing incorrect credentials)
2. OR turn off event log scraping identity source
3. OR remove event log servers

Powered by Wolken Software