Error: "reach max password reset attempt. check password policy" During SSP Deployment

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall

Issue/Introduction

SSP Deployment Fails While Connecting to vCenter

During SSP deployment, attempting to connect to vCenter fails at the "Connect to vCenter" stage. The following error is observed on the UI:

Error: "reach max password reset attempt. check password policy"

As a result, the deployment process cannot proceed.

Environment

Security Services Platform (SSP)

version 5.x

Cause

This issue is caused by a known constraint in how vCenter Server handles auto-generated passwords when specific Single Sign-On (SSO) Password Policies are enforced.

During deployment, the SSP installer automatically attempts to provision a background service account in vCenter SSO. If the vCenter SSO Password Policy has the Minimum length configured to greater than 20 characters, vCenter encounters a policy constraint issue.

vCenter rejects the auto-generated password or fails to process the policy correctly when the minimum length exceeds this threshold (supported default range is typically 8–20 characters). Consequently, vCenter rejects the account provisioning request, causing the SSP deployment to fail.

Resolution

To resolve this issue, adjust the vCenter SSO password policy to fall within supported limits:

1. Log in to the vSphere Client as [email protected] or as a member of the vCenter Single Sign-On Administrators group.

2. From the Home menu, navigate to Administration > Single Sign-On > Configuration.

3. Select the Local Accounts tab.

4. Click Edit for the Password Policy row.

5. Modify the Minimum length setting to a value of 20 or less (the default value is 8).

6. Click Save.

7. Restart the SSP deployment.

Reference: Edit the vCenter Single Sign-On Password Policy

Additional Information

Incase,  vCenter password is set at MINIMUM 20 chars long and cannot be lower. To increase the SSP-I service account pwd length.

Workaround

To unblock the deployment on the existing SSPI appliance, the secop.init script must be modified to pass the environment variable into the container.

Steps:

1. SSH into the SSPI appliance.( as sysadmin)
2. Edit the secop initialization script:

sudo vi /etc/init.d/secop.init

3. Locate the podman run command inside the run_secop_container() function.
4. Add the environment variable flag -e SECOP_SERVICE_ACCOUNT_PWDLEN=20 \ to the command. It should look like this:

podman run -d \
--replace \
--network=host \
--name secop_service \
--cap-add=NET_RAW \
--conmon-pidfile=/var/run/secop.pid \
-e SECOP_SERVICE_ACCOUNT_PWDLEN=20 \
-e KUBECONFIG='/opt/vmware/vsx/etc/admin.conf' \
...

5. Restart the secop service to recreate the container with the new variable:

sudo systemctl stop secop.service
sudo podman rm -f secop_service
sudo systemctl start secop.service