vCenter Server Active Directory permission registration OK button unresponsive

Products

• VMware vCenter Server

Issue/Introduction

When attempting to add permissions to a VMware vCenter Server inventory object via the vSphere Client (GUI), the OK button remains unresponsive after entering Active Directory user/group details, preventing the registration of new permissions.

• Navigating to Inventory > Select a target object > Permissions > ADD allows selection of domains and roles.
• When typing an AD user/group name, no search results or suggestions appear.
• Manually typing the full user string and clicking OK results in no action or feedback from the UI.
  
  
• Exact Error Message (from ssoAdminServer.log):
  [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldap://<dc_fqdn>] because [com.vmware.identity.interop.idm.IdmNativeException] with reason [Native platform error [code: 41737][LW_ERROR_KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN][Client not found in Kerberos database]]

Environment

Product: VMware vCenter Server
Configuration: The Identity Source Type is Active Directory (Integrated Windows Authentication).

Cause

The issue is caused by a communication or authentication failure between the vCenter Server and the Active Directory Domain Controller. Specifically, the Kerberos identity of the user account may be missing or invalid in the AD database (LW_ERROR_KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN), preventing the Single Sign-On (SSO) service from binding to the directory to validate the selected user/group.

Resolution

If the user account utilized during the configuration of the Identity Source is invalid, the issue can be resolved via one of the following two approaches:

• Update the user account:

1. 1. Log in to the vSphere Client.
   2. Navigate to Administration > Single Sign On > Configuration > Identity Provider.
   3. Edit the Active Directory Identity Source.
   4. Update the Username and the Password
   5. Save the changes.

• Change the Identity Source configuration to use the machine account:

1. 1. Log in to the vSphere Client.
   2. Navigate to Administration > Single Sign On > Configuration > Identity Provider.
   3. Edit the Active Directory Identity Source.
   4. Change the configuration setting from "Use Service Principal Name (SPN)" to "Use machine account."
   5. Save the changes.

These should immediately allow you to add permissions again without requiring a full re-join of the domain.

Additional Information

Integrated Windows Authentication (IWA) has been deprecated and is no longer supported in vCenter 9.0.

• Removal of Integrated Windows Authentication (IWA)
• "Integrated Windows Authentication" option is missing when adding an Identity Source in vCenter 9.0