vSphere Client login fails with error 404

Products

• VMware vCenter Server

Issue/Introduction

• Domain users cannot log in to the vSphere Client with domain credentials.

• Users receive an "Invalid Credentials" error at the vSphere login screen.

• The /var/log/vmware/sso/websso.log file in vCenter contains the following errors:

  YYYY-MM-DDTHH:MM:SSZ WARN websso[76:tomcat-http--38] [CorId=########-####-####-####-##########] [com.vmware.identity.interop.ldap.LdapErrorChecker] Error received by LDAP client: com.vmware.identity.interop.ldap.OpenLdapClientLibrary, error code: -1

  YYYY-MM-DDTHH:MM:SSZ WARN websso[76:tomcat-http--38] [CorId=########-####-####-####-##########] [com.vmware.identity.idm.server.ServerUtils] cannot bind connection: [ldaps://########.com:636, #####@#####]

  YYYY-MM-DDTHH:MM:SSZ ERROR websso[76:tomcat-http--38] [CorId=########-####-####-####-##########] [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldaps://#########.com:636 because [com.vmware.identity.interop.ldap.ServerDownLdapException] with reason [Can't contact LDAP server] therefore will try to attempt to use secondary URIs, if applicable


• Network connectivity to the LDAP server from the vCenter Server Appliance (VCSA) using the following commands fails:

  • nc -vz <LDAP server IP/FQDN> <LDAP port>

  • ping <LDAP server IP/FQDN>

Environment

• VMware vCenter Server 8.x
• VMware vCenter Server 7.x

Cause

The vCenter SSO service cannot reach or bind to the LDAP server. This is typically caused by:

• LDAP server downtime or high load.
• Network interruptions, such as firewall drops or routing issues.

Resolution

1. Investigate the external LDAP server's status and logs.

2. Remediate any underlying network connectivity issues.

3. Reconfigure the LDAP server in vCenter.

Additional Information

Single Sign-On Identity Source configuration using LDAPS in vSphere Client