Custom vsphere.local User Password Expired Unexpectedly with an exception "N9SsoClient24PasswordExpiredExceptionE".

Products

• VMware vCenter Server

Issue/Introduction

vCenter monitoring was disrupted, causing a loss of connectivity with the monitoring platform and resulting in missed critical alerts. Authentication failed for the custom local SSO user s##-#####[email protected] with the following error observed in the vpxd.log:

AcquireToken exception: N9SsoClient24PasswordExpiredExceptionE(Authentication failed: Password of the user logging on is expired. :: Password of the user logging on is expired. :: User account expired: {Name: s##-#####-vsphere, Domain: VSPHERE.LOCAL})

Additionally, vmdird.log recorded a blocked login attempt and bind request failure at the exact same timestamp:

ERROR: Bind Request Failed error 49: Protocol version: 3, Bind DN: "CN=s##-#####-vsphere,CN=Users,DC=vsphere,DC=local", Method: SASL WARNING: LoginBlocked DN (cn=s##-#####-vsphere,cn=users,dc=vsphere,dc=local), error (9239)(Account access blocked)

Environment

VMware vCenter Server

Cause

The s##-#####-vsphere account password expired under the constraints of a previously active password policy. Modifying the global password policy to 0 days (Never Expire) after the account had already reached an expired state does not retroactively resolve or un-expire the account.

Resolution

• Log into the vCenter Server using an administrator account to reset the password and unlock the s##-#####-vsphere account, immediately restoring authentication capabilities.

• Open an SSH session to the vCenter Server Appliance and authenticate as root.

• Explicitly configure the specific user account to permanently bypass expirations utilizing dir-cli:
  
  dir-cli user modify --account s##-#####-vsphere --password-never-expires true

Additional Information

Changing the global password policy via the vCenter SSO Configuration page does not apply to accounts that are already in an expired state. Individual accounts must be explicitly modified to never expire to prevent future disruptions if global policies are reverted.